CWE-888 软件弱点详情 | CVE Find

厂商与产品

CPE（Common Platform Enumeration）是一种用于命名硬件、软件和操作系统的标准化方案。CPE 提供了一种结构化命名方案，可根据厂商、产品名称、版本、更新、版次和语言等属性唯一标识和分类信息技术系统、平台和软件包。

名称: Software Fault Pattern (SFP) Clusters

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

CWE 成员

CWE-885: SFP Primary Cluster: Risky Values 类别

CWE-885: This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

CWE-998: SFP Secondary Cluster: Glitch in Computation 类别

CWE-886: SFP Primary Cluster: Unused entities 类别

CWE-886: This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

CWE-482: Comparing instead of Assigning 基础

CWE-561: Dead Code 基础

CWE-563: Assignment to Variable without Use 基础

CWE-887: SFP Primary Cluster: API 类别

CWE-887: This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

CWE-1001: SFP Secondary Cluster: Use of an Improper API 类别

CWE-889: SFP Primary Cluster: Exception Management 类别

CWE-889: This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

CWE-960: SFP Secondary Cluster: Ambiguous Exception Type 类别

CWE-961: SFP Secondary Cluster: Incorrect Exception Behavior 类别

CWE-962: SFP Secondary Cluster: Unchecked Status Condition 类别

CWE-890: SFP Primary Cluster: Memory Access 类别

CWE-890: This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

CWE-970: SFP Secondary Cluster: Faulty Buffer Access 类别

CWE-971: SFP Secondary Cluster: Faulty Pointer Use 类别

CWE-972: SFP Secondary Cluster: Faulty String Expansion 类别

CWE-973: SFP Secondary Cluster: Improper NULL Termination 类别

CWE-974: SFP Secondary Cluster: Incorrect Buffer Length Computation 类别

CWE-891: SFP Primary Cluster: Memory Management 类别

CWE-891: This category identifies Software Fault Patterns (SFPs) within the Memory Management cluster (SFP38).

CWE-969: SFP Secondary Cluster: Faulty Memory Release 类别

CWE-892: SFP Primary Cluster: Resource Management 类别

CWE-892: This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

CWE-982: SFP Secondary Cluster: Failure to Release Resource 类别

CWE-983: SFP Secondary Cluster: Faulty Resource Use 类别

CWE-984: SFP Secondary Cluster: Life Cycle 类别

CWE-985: SFP Secondary Cluster: Unrestricted Consumption 类别

CWE-893: SFP Primary Cluster: Path Resolution 类别

CWE-893: This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

CWE-979: SFP Secondary Cluster: Failed Chroot Jail 类别

CWE-980: SFP Secondary Cluster: Link in Resource Name Resolution 类别

CWE-981: SFP Secondary Cluster: Path Traversal 类别

CWE-894: SFP Primary Cluster: Synchronization 类别

CWE-894: This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).

CWE-986: SFP Secondary Cluster: Missing Lock 类别

CWE-987: SFP Secondary Cluster: Multiple Locks/Unlocks 类别

CWE-988: SFP Secondary Cluster: Race Condition Window 类别

CWE-989: SFP Secondary Cluster: Unrestricted Lock 类别

CWE-895: SFP Primary Cluster: Information Leak 类别

CWE-895: This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

CWE-963: SFP Secondary Cluster: Exposed Data 类别

CWE-964: SFP Secondary Cluster: Exposure Temporary File 类别

CWE-965: SFP Secondary Cluster: Insecure Session Management 类别

CWE-966: SFP Secondary Cluster: Other Exposures 类别

CWE-967: SFP Secondary Cluster: State Disclosure 类别

CWE-896: SFP Primary Cluster: Tainted Input 类别

CWE-896: This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

CWE-990: SFP Secondary Cluster: Tainted Input to Command 类别

CWE-991: SFP Secondary Cluster: Tainted Input to Environment 类别

CWE-992: SFP Secondary Cluster: Faulty Input Transformation 类别

CWE-993: SFP Secondary Cluster: Incorrect Input Handling 类别

CWE-994: SFP Secondary Cluster: Tainted Input to Variable 类别

CWE-897: SFP Primary Cluster: Entry Points 类别

CWE-897: This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).

CWE-1002: SFP Secondary Cluster: Unexpected Entry Points 类别

CWE-898: SFP Primary Cluster: Authentication 类别

CWE-898: This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

CWE-947: SFP Secondary Cluster: Authentication Bypass 类别

CWE-948: SFP Secondary Cluster: Digital Certificate 类别

CWE-949: SFP Secondary Cluster: Faulty Endpoint Authentication 类别

CWE-950: SFP Secondary Cluster: Hardcoded Sensitive Data 类别

CWE-951: SFP Secondary Cluster: Insecure Authentication Policy 类别

CWE-952: SFP Secondary Cluster: Missing Authentication 类别

CWE-953: SFP Secondary Cluster: Missing Endpoint Authentication 类别

CWE-954: SFP Secondary Cluster: Multiple Binds to the Same Port 类别

CWE-955: SFP Secondary Cluster: Unrestricted Authentication 类别

CWE-899: SFP Primary Cluster: Access Control 类别

CWE-899: This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

CWE-944: SFP Secondary Cluster: Access Management 类别

CWE-945: SFP Secondary Cluster: Insecure Resource Access 类别

CWE-946: SFP Secondary Cluster: Insecure Resource Permissions 类别

CWE-901: SFP Primary Cluster: Privilege 类别

CWE-901: This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).

CWE-250: Execution with Unnecessary Privileges 基础

CWE-266: Incorrect Privilege Assignment 基础

CWE-267: Privilege Defined With Unsafe Actions 基础

CWE-268: Privilege Chaining 基础

CWE-269: Improper Privilege Management 基础

CWE-270: Privilege Context Switching Error 基础

CWE-271: Privilege Dropping / Lowering Errors 基础

CWE-272: Least Privilege Violation 基础

CWE-274: Improper Handling of Insufficient Privileges 基础

CWE-520: .NET Misconfiguration: Use of Impersonation 基础

CWE-653: Improper Isolation or Compartmentalization 基础

CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods 基础

CWE-902: SFP Primary Cluster: Channel 类别

CWE-902: This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

CWE-956: SFP Secondary Cluster: Channel Attack 类别

CWE-957: SFP Secondary Cluster: Protocol Error 类别

CWE-903: SFP Primary Cluster: Cryptography 类别

CWE-903: This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

CWE-958: SFP Secondary Cluster: Broken Cryptography 类别

CWE-959: SFP Secondary Cluster: Weak Cryptography 类别

CWE-904: SFP Primary Cluster: Malware 类别

CWE-904: This category identifies Software Fault Patterns (SFPs) within the Malware cluster.

CWE-506: Embedded Malicious Code 基础

CWE-507: Trojan Horse 基础

CWE-508: Non-Replicating Malicious Code 基础

CWE-509: Replicating Malicious Code (Virus or Worm) 基础

CWE-510: Trapdoor 基础

CWE-511: Logic/Time Bomb 基础

CWE-512: Spyware 基础

CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream 基础

CWE-968: SFP Secondary Cluster: Covert Channel 类别

CWE-905: SFP Primary Cluster: Predictability 类别

CWE-905: This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

CWE-330: Use of Insufficiently Random Values 基础

CWE-331: Insufficient Entropy 基础

CWE-332: Insufficient Entropy in PRNG 基础

CWE-333: Improper Handling of Insufficient Entropy in TRNG 基础

CWE-334: Small Space of Random Values 基础

CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 基础

CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) 基础

CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) 基础

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 基础

CWE-339: Small Seed Space in PRNG 基础

CWE-340: Generation of Predictable Numbers or Identifiers 基础

CWE-341: Predictable from Observable State 基础

CWE-342: Predictable Exact Value from Previous Values 基础

CWE-343: Predictable Value Range from Previous Values 基础

CWE-344: Use of Invariant Value in Dynamically Changing Context 基础

CWE-906: SFP Primary Cluster: UI 类别

CWE-906: This category identifies Software Fault Patterns (SFPs) within the UI cluster.

CWE-995: SFP Secondary Cluster: Feature 类别

CWE-996: SFP Secondary Cluster: Security 类别

CWE-997: SFP Secondary Cluster: Information Loss 类别

CWE-907: SFP Primary Cluster: Other 类别

CWE-907: This category identifies Software Fault Patterns (SFPs) within the Other cluster.

CWE-975: SFP Secondary Cluster: Architecture 类别

CWE-976: SFP Secondary Cluster: Compiler 类别

CWE-977: SFP Secondary Cluster: Design 类别

CWE-978: SFP Secondary Cluster: Implementation 类别

CWE-1237: SFP Primary Cluster: Faulty Resource Release 类别

CWE-1237: This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Release cluster (SFP37).

CWE-415: Double Free 基础

CWE-762: Mismatched Memory Management Routines 基础

CWE-763: Release of Invalid Pointer or Reference 基础

CWE-1238: SFP Primary Cluster: Failure to Release Memory 类别

CWE-1238: This category identifies Software Fault Patterns (SFPs) within the Failure to Release Memory cluster (SFP38).

CWE-401: Missing Release of Memory after Effective Lifetime 基础

CWE 视图信息

漏洞映射说明

依据 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
备注 : Use this View or other Views to search and navigate for the appropriate weakness.

目标受众

利益相关方	描述
Applied Researchers
Academic Researchers
Product Vendors

提交记录

名称	组织	日期	发布日期	Version
CWE Content Team	MITRE	2012-03-22 +00:00	2012-05-14 +00:00	2.2

修改记录

名称	组织	日期	备注
CWE Content Team	MITRE	2020-02-24 +00:00	updated References, View_Audience
CWE Content Team	MITRE	2020-08-20 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated References

参考资料

REF-19

System Assurance
Nikolai Mansourov, Djenana Campara.
https://www.elsevier.com/books/system-assurance/mansourov/978-0-12-381414-2

REF-20

Task Order 0006: Vulnerability Path Analysis and Demonstration (VPAD). Volume 2 - White Box Definitions of Software Fault Patterns
Ben Calloni, Nikolai Mansourov, Djenana Campara.
https://apps.dtic.mil/sti/tr/pdf/ADB381215.pdf