简体中文

CWE-884 视图详情

CWE-884

CWE Cross-section
2011-12-15 +00:00
Incomplete
Explicit
2023-06-29 +00:00
CWE Mitre.org
指定 CWE 通知
随时了解指定 CWE 的变更。
管理通知

名称: CWE Cross-section

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

CWE 成员

CWE-14: Compiler Removal of Code to Clear Buffers 基础

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 基础

CWE-23: Relative Path Traversal 基础

CWE-36: Absolute Path Traversal 基础

CWE-41: Improper Resolution of Path Equivalence 基础

CWE-59: Improper Link Resolution Before File Access 基础

CWE-78: Improper Neutralization of Special Elements used in an OS Command 基础

CWE-79: Improper Neutralization of Input During Web Page Generation 基础

CWE-88: Improper Neutralization of Argument Delimiters in a Command 基础

CWE-89: Improper Neutralization of Special Elements used in an SQL Command 基础

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 基础

CWE-94: Improper Control of Generation of Code 基础

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code 基础

CWE-96: Improper Neutralization of Directives in Statically Saved Code 基础

CWE-99: Improper Control of Resource Identifiers 基础

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 基础

CWE-117: Improper Output Neutralization for Logs 基础

CWE-120: Buffer Copy without Checking Size of Input 基础

CWE-129: Improper Validation of Array Index 基础

CWE-131: Incorrect Calculation of Buffer Size 基础

CWE-134: Use of Externally-Controlled Format String 基础

CWE-135: Incorrect Calculation of Multi-Byte String Length 基础

CWE-170: Improper Null Termination 基础

CWE-173: Improper Handling of Alternate Encoding 基础

CWE-174: Double Decoding of the Same Data 基础

CWE-175: Improper Handling of Mixed Encoding 基础

CWE-179: Incorrect Behavior Order: Early Validation 基础

CWE-185: Incorrect Regular Expression 基础

CWE-190: Integer Overflow or Wraparound 基础

CWE-191: Integer Underflow (Wrap or Wraparound) 基础

CWE-193: Off-by-one Error 基础

CWE-203: Observable Discrepancy 基础

CWE-209: Generation of Error Message Containing Sensitive Information 基础

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer 基础

CWE-222: Truncation of Security-relevant Information 基础

CWE-223: Omission of Security-relevant Information 基础

CWE-228: Improper Handling of Syntactically Invalid Structure 基础

CWE-244: Improper Clearing of Heap Memory Before Release 基础

CWE-248: Uncaught Exception 基础

CWE-250: Execution with Unnecessary Privileges 基础

CWE-252: Unchecked Return Value 基础

CWE-253: Incorrect Check of Function Return Value 基础

CWE-262: Not Using Password Aging 基础

CWE-263: Password Aging with Long Expiration 基础

CWE-266: Incorrect Privilege Assignment 基础

CWE-267: Privilege Defined With Unsafe Actions 基础

CWE-268: Privilege Chaining 基础

CWE-270: Privilege Context Switching Error 基础

CWE-271: Privilege Dropping / Lowering Errors 基础

CWE-273: Improper Check for Dropped Privileges 基础

CWE-283: Unverified Ownership 基础

CWE-290: Authentication Bypass by Spoofing 基础

CWE-294: Authentication Bypass by Capture-replay 基础

CWE-296: Improper Following of a Certificate's Chain of Trust 基础

CWE-299: Improper Check for Certificate Revocation 基础

CWE-300: Channel Accessible by Non-Endpoint 基础

CWE-301: Reflection Attack in an Authentication Protocol 基础

CWE-304: Missing Critical Step in Authentication 基础

CWE-306: Missing Authentication for Critical Functionality 基础

CWE-307: Improper Restriction of Excessive Authentication Attempts 基础

CWE-308: Use of Single-factor Authentication 基础

CWE-312: Cleartext Storage of Sensitive Information 基础

CWE-319: Cleartext Transmission of Sensitive Information 基础

CWE-322: Key Exchange without Entity Authentication 基础

CWE-323: Reusing a Nonce, Key Pair in Encryption 基础

CWE-325: Missing Cryptographic Step 基础

CWE-327: Use of a Broken or Risky Cryptographic Algorithm 基础

CWE-331: Insufficient Entropy 基础

CWE-334: Small Space of Random Values 基础

CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 基础

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 基础

CWE-341: Predictable from Observable State 基础

CWE-347: Improper Verification of Cryptographic Signature 基础

CWE-348: Use of Less Trusted Source 基础

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data 基础

CWE-352: Cross-Site Request Forgery 基础

CWE-353: Missing Support for Integrity Check 基础

CWE-354: Improper Validation of Integrity Check Value 基础

CWE-364: Signal Handler Race Condition 基础

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition 基础

CWE-369: Divide By Zero 基础

CWE-390: Detection of Error Condition Without Action 基础

CWE-392: Missing Report of Error Condition 基础

CWE-393: Return of Wrong Status Code 基础

CWE-400: Uncontrolled Resource Consumption 基础

CWE-406: Insufficient Control of Network Message Volume (Network Amplification) 基础

CWE-407: Inefficient Algorithmic Complexity 基础

CWE-408: Incorrect Behavior Order: Early Amplification 基础

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) 基础

CWE-434: Unrestricted Upload of File with Dangerous Type 基础

CWE-444: Inconsistent Interpretation of HTTP Requests 基础

CWE-451: User Interface (UI) Misrepresentation of Critical Information 基础

CWE-453: Insecure Default Variable Initialization 基础

CWE-454: External Initialization of Trusted Variables or Data Stores 基础

CWE-455: Non-exit on Failed Initialization 基础

CWE-456: Missing Initialization of a Variable 基础

CWE-467: Use of sizeof() on a Pointer Type 基础

CWE-468: Incorrect Pointer Scaling 基础

CWE-469: Use of Pointer Subtraction to Determine Size 基础

CWE-470: Use of Externally-Controlled Input to Select Classes or Code 基础

CWE-476: NULL Pointer Dereference 基础

CWE-478: Missing Default Case in Multiple Condition Expression 基础

CWE-480: Use of Incorrect Operator 基础

CWE-483: Incorrect Block Delimitation 基础

CWE-484: Omitted Break Statement in Switch 基础

CWE-486: Comparison of Classes by Name 基础

CWE-494: Download of Code Without Integrity Check 基础

CWE-495: Private Data Structure Returned From A Public Method 基础

CWE-496: Public Data Assigned to Private Array-Typed Field 基础

CWE-498: Cloneable Class Containing Sensitive Information 基础

CWE-499: Serializable Class Containing Sensitive Data 基础

CWE-502: Deserialization of Untrusted Data 基础

CWE-521: Weak Password Requirements 基础

CWE-522: Insufficiently Protected Credentials 基础

CWE-546: Suspicious Comment 基础

CWE-547: Use of Hard-coded, Security-relevant Constants 基础

CWE-561: Dead Code 基础

CWE-563: Assignment to Variable without Use 基础

CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context 基础

CWE-587: Assignment of a Fixed Address to a Pointer 基础

CWE-595: Comparison of Object References Instead of Object Contents 基础

CWE-601: URL Redirection to Untrusted Site 基础

CWE-602: Client-Side Enforcement of Server-Side Security 基础

CWE-605: Multiple Binds to the Same Port 基础

CWE-617: Reachable Assertion 基础

CWE-621: Variable Extraction Error 基础

CWE-627: Dynamic Variable Evaluation 基础

CWE-628: Function Call with Incorrectly Specified Arguments 基础

CWE-642: External Control of Critical State Data 基础

CWE-648: Incorrect Use of Privileged APIs 基础

CWE-667: Improper Locking 基础

CWE-672: Operation on a Resource after Expiration or Release 基础

CWE-674: Uncontrolled Recursion 基础

CWE-676: Use of Potentially Dangerous Function 基础

CWE-681: Incorrect Conversion between Numeric Types 基础

CWE-698: Execution After Redirect (EAR) 基础

CWE-708: Incorrect Ownership Assignment 基础

CWE-732: Incorrect Permission Assignment for Critical Resource 基础

CWE-756: Missing Custom Error Page 基础

CWE-763: Release of Invalid Pointer or Reference 基础

CWE-770: Allocation of Resources Without Limits or Throttling 基础

CWE-772: Missing Release of Resource after Effective Lifetime 基础

CWE-783: Operator Precedence Logic Error 基础

CWE-786: Access of Memory Location Before Start of Buffer 基础

CWE-788: Access of Memory Location After End of Buffer 基础

CWE-798: Use of Hard-coded Credentials 基础

CWE-805: Buffer Access with Incorrect Length Value 基础

CWE-807: Reliance on Untrusted Inputs in a Security Decision 基础

CWE-822: Untrusted Pointer Dereference 基础

CWE-825: Expired Pointer Dereference 基础

CWE-829: Inclusion of Functionality from Untrusted Control Sphere 基础

CWE-835: Loop with Unreachable Exit Condition 基础

CWE-838: Inappropriate Encoding for Output Context 基础

CWE-839: Numeric Range Comparison Without Minimum Check 基础

CWE-841: Improper Enforcement of Behavioral Workflow 基础

CWE-862: Missing Authorization 基础

CWE-863: Incorrect Authorization 基础

CWE 视图信息

漏洞映射说明

依据 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
备注 : Use this View or other Views to search and navigate for the appropriate weakness.

提交记录

名称 组织 日期 发布日期 Version
CWE Content Team MITRE 2011-12-15 +00:00 2012-05-14 +00:00 2.2

修改记录

名称 组织 日期 备注
CWE Content Team MITRE 2017-05-03 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
cvefind.com 上展示的信息来源于多个精心选择的权威数据源。CVE 数据由 MITRE Corporation 和 National Vulnerability Database (NVD) 提供。已知被利用漏洞（KEV）目录来源于 Cybersecurity and Infrastructure Security Agency (CISA)，EPSS 评分来自 FIRST.org。此外，软件弱点（CWE）和常见攻击模式（CAPEC）数据由 MITRE Corporation 维护，硬件和软件配置（CPE）信息由 NVD 提供。