简体中文

CWE-868 视图详情

CWE-868

Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version)
2011-08-04 +00:00
Obsolete
Graph
2023-06-29 +00:00
CWE Mitre.org
指定 CWE 通知
随时了解指定 CWE 的变更。
管理通知

名称: Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version)

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

CWE 成员

CWE-876: Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer 基础
CWE-128: Wrap-around Error 基础
CWE-131: Incorrect Calculation of Buffer Size 基础
CWE-190: Integer Overflow or Wraparound 基础
CWE-20: Improper Input Validation 基础
CWE-226: Sensitive Information in Resource Not Removed Before Reuse 基础
CWE-244: Improper Clearing of Heap Memory Before Release 基础
CWE-252: Unchecked Return Value 基础
CWE-391: DEPRECATED: Unchecked Error Condition 基础
CWE-404: Improper Resource Shutdown or Release 基础
CWE-415: Double Free 基础
CWE-416: Use After Free 基础
CWE-476: NULL Pointer Dereference 基础
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere 基础
CWE-590: Free of Memory not on the Heap 基础
CWE-591: Sensitive Data Storage in Improperly Locked Memory 基础
CWE-665: Improper Initialization 基础
CWE-687: Function Call With Incorrectly Specified Argument Value 基础
CWE-690: Unchecked Return Value to NULL Pointer Dereference 基础
CWE-703: Improper Check or Handling of Exceptional Conditions 基础
CWE-754: Improper Check for Unusual or Exceptional Conditions 基础
CWE-762: Mismatched Memory Management Routines 基础
CWE-770: Allocation of Resources Without Limits or Throttling 基础
CWE-822: Untrusted Pointer Dereference 基础
CWE-877: Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer 基础
CWE-134: Use of Externally-Controlled Format String 基础
CWE-22: Improper Limitation of a Pathname to a Restricted Directory 基础
CWE-241: Improper Handling of Unexpected Data Type 基础
CWE-276: Incorrect Default Permissions 基础
CWE-279: Incorrect Execution-Assigned Permissions 基础
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 基础
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition 基础
CWE-37: Path Traversal: '/absolute/pathname/here' 基础
CWE-379: Creation of Temporary File in Directory with Insecure Permissions 基础
CWE-38: Path Traversal: '\absolute\pathname\here' 基础
CWE-39: Path Traversal: 'C:dirname' 基础
CWE-391: DEPRECATED: Unchecked Error Condition 基础
CWE-403: Exposure of File Descriptor to Unintended Control Sphere 基础
CWE-404: Improper Resource Shutdown or Release 基础
CWE-41: Improper Resolution of Path Equivalence 基础
CWE-552: Files or Directories Accessible to External Parties 基础
CWE-59: Improper Link Resolution Before File Access 基础
CWE-62: UNIX Hard Link 基础
CWE-64: Windows Shortcut Following (.LNK) 基础
CWE-65: Windows Hard Link 基础
CWE-67: Improper Handling of Windows Device Names 基础
CWE-675: Multiple Operations on Resource in Single-Operation Context 基础
CWE-676: Use of Potentially Dangerous Function 基础
CWE-73: External Control of File Name or Path 基础
CWE-732: Incorrect Permission Assignment for Critical Resource 基础
CWE-770: Allocation of Resources Without Limits or Throttling 基础

CWE 视图信息

漏洞映射说明

依据 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
备注 : Use this View or other Views to search and navigate for the appropriate weakness.

备注

The relationships in this view were determined based on specific statements within the rules from the standard. Not all rules have direct relationships to individual weaknesses, although they likely have chaining relationships in specific circumstances.

目标受众

利益相关方 描述
Software Developers By following the CERT C++ Secure Coding Standard, developers will be able to fully or partially prevent the weaknesses that are identified in this view. In addition, developers can use a CWE coverage graph to determine which weaknesses are not directly addressed by the standard, which will help identify and resolve remaining gaps in training, tool acquisition, or other approaches for reducing weaknesses.
Product Customers If a software developer claims to be following the CERT C++ Secure Coding Standard, then customers can search for the weaknesses in this view in order to formulate independent evidence of that claim.
Educators Educators can use this view in multiple ways. For example, if there is a focus on teaching weaknesses, the educator could link them to the relevant Secure Coding Standard.

提交记录

名称 组织 日期 发布日期 Version
CWE Content Team MITRE 2011-08-04 +00:00 2011-09-13 +00:00 2.1

修改记录

名称 组织 日期 备注
CWE Content Team MITRE 2019-01-03 +00:00 updated Description, Maintenance_Notes, Name, References
CWE Content Team MITRE 2020-02-24 +00:00 updated View_Audience
CWE Content Team MITRE 2021-03-15 +00:00 updated Description, Maintenance_Notes
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

参考资料

REF-847

SEI CERT C++ Coding Standard
The Software Engineering Institute.
https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=88046682

cvefind.com 上展示的信息来源于多个精心选择的权威数据源。CVE 数据由 MITRE Corporation 和 National Vulnerability Database (NVD) 提供。已知被利用漏洞（KEV）目录来源于 Cybersecurity and Infrastructure Security Agency (CISA)，EPSS 评分来自 FIRST.org。此外，软件弱点（CWE）和常见攻击模式（CAPEC）数据由 MITRE Corporation 维护，硬件和软件配置（CPE）信息由 NVD 提供。