CWE-635 软件弱点详情 | CVE Find

厂商与产品

CPE（Common Platform Enumeration）是一种用于命名硬件、软件和操作系统的标准化方案。CPE 提供了一种结构化命名方案，可根据厂商、产品名称、版本、更新、版次和语言等属性唯一标识和分类信息技术系统、平台和软件包。

名称: Weaknesses Originally Used by NVD from 2008 to 2016

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

CWE 成员

CWE-16: Configuration 类别

CWE-16: Weaknesses in this category are typically introduced during the configuration of the software.

CWE-189: Numeric Errors 类别

CWE-189: Weaknesses in this category are related to improper calculation or conversion of numbers.

CWE-128: Wrap-around Error 基础

CWE-190: Integer Overflow or Wraparound 基础

CWE-191: Integer Underflow (Wrap or Wraparound) 基础

CWE-193: Off-by-one Error 基础

CWE-369: Divide By Zero 基础

CWE-681: Incorrect Conversion between Numeric Types 基础

CWE-839: Numeric Range Comparison Without Minimum Check 基础

CWE-1335: Incorrect Bitwise Shift of Integer 基础

CWE-1339: Insufficient Precision or Accuracy of a Real Number 基础

CWE-1389: Incorrect Parsing of Numbers with Different Radices 基础

CWE-255: Credentials Management Errors 类别

CWE-255: Weaknesses in this category are related to the management of credentials.

CWE-256: Plaintext Storage of a Password 基础

CWE-257: Storing Passwords in a Recoverable Format 基础

CWE-260: Password in Configuration File 基础

CWE-261: Weak Encoding for Password 基础

CWE-262: Not Using Password Aging 基础

CWE-263: Password Aging with Long Expiration 基础

CWE-324: Use of a Key Past its Expiration Date 基础

CWE-521: Weak Password Requirements 基础

CWE-523: Unprotected Transport of Credentials 基础

CWE-549: Missing Password Field Masking 基础

CWE-620: Unverified Password Change 基础

CWE-640: Weak Password Recovery Mechanism for Forgotten Password 基础

CWE-798: Use of Hard-coded Credentials 基础

CWE-916: Use of Password Hash With Insufficient Computational Effort 基础

CWE-1392: Use of Default Credentials 基础

CWE-264: Permissions, Privileges, and Access Controls 类别

CWE-264: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

CWE-310: Cryptographic Issues 类别

CWE-310: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

CWE-261: Weak Encoding for Password 基础

CWE-324: Use of a Key Past its Expiration Date 基础

CWE-325: Missing Cryptographic Step 基础

CWE-328: Use of Weak Hash 基础

CWE-331: Insufficient Entropy 基础

CWE-334: Small Space of Random Values 基础

CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 基础

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 基础

CWE-347: Improper Verification of Cryptographic Signature 基础

CWE-916: Use of Password Hash With Insufficient Computational Effort 基础

CWE-1204: Generation of Weak Initialization Vector (IV) 基础

CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation 基础

CWE-399: Resource Management Errors 类别

CWE-399: Weaknesses in this category are related to improper management of system resources.

CWE-73: External Control of File Name or Path 基础

CWE-403: Exposure of File Descriptor to Unintended Control Sphere 基础

CWE-410: Insufficient Resource Pool 基础

CWE-470: Use of Externally-Controlled Input to Select Classes or Code 基础

CWE-502: Deserialization of Untrusted Data 基础

CWE-619: Dangling Database Cursor 基础

CWE-641: Improper Restriction of Names for Files and Other Resources 基础

CWE-694: Use of Multiple Resources with Duplicate Identifier 基础

CWE-763: Release of Invalid Pointer or Reference 基础

CWE-770: Allocation of Resources Without Limits or Throttling 基础

CWE-771: Missing Reference to Active Allocated Resource 基础

CWE-772: Missing Release of Resource after Effective Lifetime 基础

CWE-826: Premature Release of Resource During Expected Lifetime 基础

CWE-908: Use of Uninitialized Resource 基础

CWE-909: Missing Initialization of Resource 基础

CWE-910: Use of Expired File Descriptor 基础

CWE-911: Improper Update of Reference Count 基础

CWE-914: Improper Control of Dynamically-Identified Variables 基础

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes 基础

CWE-920: Improper Restriction of Power Consumption 基础

CWE-1188: Initialization of a Resource with an Insecure Default 基础

CWE-1341: Multiple Releases of Same Resource or Handle 基础

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer 基础

CWE-134: Use of Externally-Controlled Format String 基础

CWE-20: Improper Input Validation 基础

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor 基础

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 基础

CWE-287: Improper Authentication 基础

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 基础

CWE-59: Improper Link Resolution Before File Access 基础

CWE-78: Improper Neutralization of Special Elements used in an OS Command 基础

CWE-79: Improper Neutralization of Input During Web Page Generation 基础

CWE-89: Improper Neutralization of Special Elements used in an SQL Command 基础

CWE-94: Improper Control of Generation of Code 基础

CWE-352: Cross-Site Request Forgery 基础

CWE 视图信息

漏洞映射说明

依据 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
备注 : Use this View or other Views to search and navigate for the appropriate weakness.

备注

提交记录

名称	组织	日期	发布日期	Version
CWE Content Team	MITRE	2007-10-01 +00:00	2007-10-01 +00:00	Draft 7

修改记录

名称	组织	日期	备注
CWE Content Team	MITRE	2008-09-08 +00:00	updated Maintenance_Notes, Relationships, References, View_Structure
CWE Content Team	MITRE	2017-01-19 +00:00	updated Description, Maintenance_Notes
CWE Content Team	MITRE	2017-11-08 +00:00	updated Description, Maintenance_Notes, Name
CWE Content Team	MITRE	2021-03-15 +00:00	updated Maintenance_Notes
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated References

参考资料

REF-1

CWE - Common Weakness Enumeration
NIST.
https://nvd.nist.gov/vuln/categories