繁體中文

CWE-1400 檢視詳細資料

CWE-1400

Comprehensive Categorization for Software Assurance Trends
2023-04-25 +00:00
Draft
Graph
2023-06-29 +00:00
CWE Mitre.org
指定 CWE 通知
掌握特定 CWE 的任何變更。
管理通知

名稱: Comprehensive Categorization for Software Assurance Trends

CWE 成員

CWE-1396: Weaknesses in this category are related to access control.
CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods 基礎
CWE-13: ASP.NET Misconfiguration: Password in Configuration File 基礎
CWE-202: Exposure of Sensitive Information Through Data Queries 基礎
CWE-256: Plaintext Storage of a Password 基礎
CWE-257: Storing Passwords in a Recoverable Format 基礎
CWE-258: Empty Password in Configuration File 基礎
CWE-259: Use of Hard-coded Password 基礎
CWE-260: Password in Configuration File 基礎
CWE-261: Weak Encoding for Password 基礎
CWE-262: Not Using Password Aging 基礎
CWE-263: Password Aging with Long Expiration 基礎
CWE-266: Incorrect Privilege Assignment 基礎
CWE-267: Privilege Defined With Unsafe Actions 基礎
CWE-268: Privilege Chaining 基礎
CWE-269: Improper Privilege Management 基礎
CWE-270: Privilege Context Switching Error 基礎
CWE-271: Privilege Dropping / Lowering Errors 基礎
CWE-272: Least Privilege Violation 基礎
CWE-273: Improper Check for Dropped Privileges 基礎
CWE-274: Improper Handling of Insufficient Privileges 基礎
CWE-276: Incorrect Default Permissions 基礎
CWE-277: Insecure Inherited Permissions 基礎
CWE-278: Insecure Preserved Inherited Permissions 基礎
CWE-279: Incorrect Execution-Assigned Permissions 基礎
CWE-280: Improper Handling of Insufficient Permissions or Privileges 基礎
CWE-281: Improper Preservation of Permissions 基礎
CWE-282: Improper Ownership Management 基礎
CWE-283: Unverified Ownership 基礎
CWE-284: Improper Access Control 基礎
CWE-285: Improper Authorization 基礎
CWE-286: Incorrect User Management 基礎
CWE-287: Improper Authentication 基礎
CWE-288: Authentication Bypass Using an Alternate Path or Channel 基礎
CWE-289: Authentication Bypass by Alternate Name 基礎
CWE-290: Authentication Bypass by Spoofing 基礎
CWE-291: Reliance on IP Address for Authentication 基礎
CWE-293: Using Referer Field for Authentication 基礎
CWE-294: Authentication Bypass by Capture-replay 基礎
CWE-295: Improper Certificate Validation 基礎
CWE-296: Improper Following of a Certificate's Chain of Trust 基礎
CWE-297: Improper Validation of Certificate with Host Mismatch 基礎
CWE-298: Improper Validation of Certificate Expiration 基礎
CWE-299: Improper Check for Certificate Revocation 基礎
CWE-300: Channel Accessible by Non-Endpoint 基礎
CWE-301: Reflection Attack in an Authentication Protocol 基礎
CWE-302: Authentication Bypass by Assumed-Immutable Data 基礎
CWE-303: Incorrect Implementation of Authentication Algorithm 基礎
CWE-304: Missing Critical Step in Authentication 基礎
CWE-305: Authentication Bypass by Primary Weakness 基礎
CWE-306: Missing Authentication for Critical Functionality 基礎
CWE-307: Improper Restriction of Excessive Authentication Attempts 基礎
CWE-308: Use of Single-factor Authentication 基礎
CWE-309: Use of Password System for Primary Authentication 基礎
CWE-321: Use of Hard-coded Cryptographic Key 基礎
CWE-322: Key Exchange without Entity Authentication 基礎
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action 基礎
CWE-370: Missing Check for Certificate Revocation after Initial Check 基礎
CWE-384: Session Fixation 基礎
CWE-419: Unprotected Primary Channel 基礎
CWE-420: Unprotected Alternate Channel 基礎
CWE-421: Race Condition During Access to Alternate Channel 基礎
CWE-422: Unprotected Windows Messaging Channel 基礎
CWE-425: Direct Request 基礎
CWE-441: Unintended Proxy or Intermediary 基礎
CWE-520: .NET Misconfiguration: Use of Impersonation 基礎
CWE-521: Weak Password Requirements 基礎
CWE-522: Insufficiently Protected Credentials 基礎
CWE-523: Unprotected Transport of Credentials 基礎
CWE-549: Missing Password Field Masking 基礎
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization 基礎
CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File 基礎
CWE-556: ASP.NET Misconfiguration: Use of Identity Impersonation 基礎
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key 基礎
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created 基礎
CWE-599: Missing Validation of OpenSSL Certificate 基礎
CWE-601: URL Redirection to Untrusted Site 基礎
CWE-603: Use of Client-Side Authentication 基礎
CWE-611: Improper Restriction of XML External Entity Reference 基礎
CWE-612: Improper Authorization of Index Containing Sensitive Information 基礎
CWE-613: DEPRECATED: Insufficient Session Expiration 基礎
CWE-620: Unverified Password Change 基礎
CWE-623: Unsafe ActiveX Control Marked Safe For Scripting 基礎
CWE-639: Authorization Bypass Through User-Controlled Key 基礎
CWE-640: Weak Password Recovery Mechanism for Forgotten Password 基礎
CWE-645: Overly Restrictive Account Lockout Mechanism 基礎
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions 基礎
CWE-648: Incorrect Use of Privileged APIs 基礎
CWE-708: Incorrect Ownership Assignment 基礎
CWE-732: Incorrect Permission Assignment for Critical Resource 基礎
CWE-798: Use of Hard-coded Credentials 基礎
CWE-804: Guessable CAPTCHA 基礎
CWE-836: Use of Password Hash Instead of Password for Authentication 基礎
CWE-842: Placement of User into Incorrect Group 基礎
CWE-862: Missing Authorization 基礎
CWE-863: Incorrect Authorization 基礎
CWE-918: Server-Side Request Forgery 基礎
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control 基礎
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints 基礎
CWE-925: Improper Verification of Intent by Broadcast Receiver 基礎
CWE-926: Improper Export of Android Application Components 基礎
CWE-927: Use of Implicit Intent for Sensitive Communication 基礎
CWE-939: Improper Authorization in Handler for Custom URL Scheme 基礎
CWE-940: Improper Verification of Source of a Communication Channel 基礎
CWE-941: Incorrectly Specified Destination in a Communication Channel 基礎
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains 基礎
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag 基礎
CWE-1021: Improper Restriction of Rendered UI Layers or Frames 基礎
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access 基礎
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control 基礎
CWE-1220: Insufficient Granularity of Access Control 基礎
CWE-1222: Insufficient Granularity of Address Regions Protected by Register Locks 基礎
CWE-1224: Improper Restriction of Write-Once Bit Fields 基礎
CWE-1230: Exposure of Sensitive Information Through Metadata 基礎
CWE-1231: Improper Prevention of Lock Bit Modification 基礎
CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit Protection 基礎
CWE-1242: Inclusion of Undocumented Features or Chicken Bits 基礎
CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug 基礎
CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State 基礎
CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations 基礎
CWE-1256: Improper Restriction of Software Interfaces to Hardware Features 基礎
CWE-1257: Improper Access Control Applied to Mirrored or Aliased Memory Regions 基礎
CWE-1259: Improper Restriction of Security Token Assignment 基礎
CWE-1260: Improper Handling of Overlap Between Protected Memory Ranges 基礎
CWE-1262: Improper Access Control for Register Interface 基礎
CWE-1263: Improper Physical Access Control 基礎
CWE-1267: Policy Uses Obsolete Encoding 基礎
CWE-1268: Policy Privileges are not Assigned Consistently Between Control and Data Agents 基礎
CWE-1270: Generation of Incorrect Security Tokens 基礎
CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code 基礎
CWE-1275: Sensitive Cookie with Improper SameSite Attribute 基礎
CWE-1276: Hardware Child Block Incorrectly Connected to Parent System 基礎
CWE-1283: Mutable Attestation or Measurement Reporting Data 基礎
CWE-1290: Incorrect Decoding of Security Identifiers 基礎
CWE-1292: Incorrect Conversion of Security Identifiers 基礎
CWE-1294: Insecure Security Identifier Mechanism 基礎
CWE-1296: Incorrect Chaining or Granularity of Debug Components 基礎
CWE-1297: Unprotected Confidential Information on Device is Accessible by OSAT Vendors 基礎
CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface 基礎
CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) 基礎
CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation 基礎
CWE-1311: Improper Translation of Security Attributes by Fabric Bridge 基礎
CWE-1312: Missing Protection for Mirrored Regions in On-Chip Fabric Firewall 基礎
CWE-1313: Hardware Allows Activation of Test or Debug Logic at Runtime 基礎
CWE-1314: Missing Write Protection for Parametric Data Values 基礎
CWE-1315: Improper Setting of Bus Controlling Capability in Fabric End-point 基礎
CWE-1316: Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges 基礎
CWE-1317: Improper Access Control in Fabric Bridge 基礎
CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals 基礎
CWE-1323: Improper Management of Sensitive Trace Data 基礎
CWE-1328: Security Version Number Mutable to Older Versions 基礎
CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy 基礎
CWE-1390: Weak Authentication 基礎
CWE-1391: Use of Weak Credentials 基礎
CWE-1392: Use of Default Credentials 基礎
CWE-1393: Use of Default Password 基礎
CWE-1394: Use of Default Cryptographic Key 基礎
CWE-1401: Weaknesses in this category are related to concurrency.
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 基礎
CWE-363: Race Condition Enabling Link Following 基礎
CWE-364: Signal Handler Race Condition 基礎
CWE-366: Race Condition within a Thread 基礎
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition 基礎
CWE-368: Context Switching Race Condition 基礎
CWE-412: Unrestricted Externally Accessible Lock 基礎
CWE-413: Improper Resource Locking 基礎
CWE-414: Missing Lock Check 基礎
CWE-432: Dangerous Signal Handler not Disabled During Sensitive Operations 基礎
CWE-479: Signal Handler Use of a Non-reentrant Function 基礎
CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context 基礎
CWE-558: Use of getlogin() in Multithreaded Application 基礎
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context 基礎
CWE-572: Call to Thread run() instead of start() 基礎
CWE-574: EJB Bad Practices: Use of Synchronization Primitives 基礎
CWE-591: Sensitive Data Storage in Improperly Locked Memory 基礎
CWE-609: Double-Checked Locking 基礎
CWE-663: Use of a Non-reentrant Function in a Concurrent Context 基礎
CWE-667: Improper Locking 基礎
CWE-689: Permission Race Condition During Resource Copy 基礎
CWE-764: Multiple Locks of a Critical Resource 基礎
CWE-765: Multiple Unlocks of a Critical Resource 基礎
CWE-820: Missing Synchronization 基礎
CWE-821: Incorrect Synchronization 基礎
CWE-828: Signal Handler with Functionality that is not Asynchronous-Safe 基礎
CWE-831: Signal Handler Function Associated with Multiple Signals 基礎
CWE-832: Unlock of a Resource that is not Locked 基礎
CWE-833: Deadlock 基礎
CWE-1058: Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element 基礎
CWE-1088: Synchronous Access of Remote Resource without Timeout 基礎
CWE-1096: Singleton Class Instance Creation without Proper Locking or Synchronization 基礎
CWE-1223: Race Condition for Write-Once Attributes 基礎
CWE-1232: Improper Lock Behavior After Power State Transition 基礎
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks 基礎
CWE-1264: Hardware Logic with Insecure De-Synchronization between Control and Data Channels 基礎
CWE-1298: Hardware Logic Contains Race Conditions 基礎
CWE-1403: Weaknesses in this category are related to exposed resource.
CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote 基礎
CWE-15: External Control of System or Configuration Setting 基礎
CWE-73: External Control of File Name or Path 基礎
CWE-114: Process Control 基礎
CWE-219: Storage of File with Sensitive Data Under Web Root 基礎
CWE-220: Storage of File With Sensitive Data Under FTP Root 基礎
CWE-374: Passing Mutable Objects to an Untrusted Method 基礎
CWE-375: Returning a Mutable Object to an Untrusted Caller 基礎
CWE-377: DEPRECATED: Insecure Temporary File 基礎
CWE-378: Creation of Temporary File With Insecure Permissions 基礎
CWE-379: Creation of Temporary File in Directory with Insecure Permissions 基礎
CWE-402: Transmission of Private Resources into a New Sphere 基礎
CWE-403: Exposure of File Descriptor to Unintended Control Sphere 基礎
CWE-426: Untrusted Search Path 基礎
CWE-427: Uncontrolled Search Path Element 基礎
CWE-428: Unquoted Search Path or Element 基礎
CWE-433: Unparsed Raw Web Content Delivery 基礎
CWE-472: External Control of Assumed-Immutable Web Parameter 基礎
CWE-488: Exposure of Data Element to Wrong Session 基礎
CWE-491: Public cloneable() Method Without Final 基礎
CWE-492: Use of Inner Class Containing Sensitive Data 基礎
CWE-493: Critical Public Variable Without Final Modifier 基礎
CWE-498: Cloneable Class Containing Sensitive Information 基礎
CWE-499: Serializable Class Containing Sensitive Data 基礎
CWE-500: Public Static Field Not Marked Final 基礎
CWE-524: Use of Cache Containing Sensitive Information 基礎
CWE-525: Use of Web Browser Cache Containing Sensitive Information 基礎
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere 基礎
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere 基礎
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere 基礎
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere 基礎
CWE-539: Use of Persistent Cookies Containing Sensitive Information 基礎
CWE-552: Files or Directories Accessible to External Parties 基礎
CWE-553: Command Shell in Externally Accessible Directory 基礎
CWE-565: Reliance on Cookies without Validation and Integrity Checking 基礎
CWE-582: Array Declared Public, Final, and Static 基礎
CWE-583: finalize() Method Declared Public 基礎
CWE-608: Struts: Non-private Field in ActionForm Class 基礎
CWE-619: Dangling Database Cursor 基礎
CWE-642: External Control of Critical State Data 基礎
CWE-668: Exposure of Resource to Wrong Sphere 基礎
CWE-767: Access to Critical Private Variable via Public Method 基礎
CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision 基礎
CWE-1282: Assumed-Immutable Data is Stored in Writable Memory 基礎
CWE-1327: Binding to an Unrestricted IP Address 基礎
CWE-1404: Weaknesses in this category are related to file handling.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory 基礎
CWE-23: Relative Path Traversal 基礎
CWE-24: Path Traversal: '../filedir' 基礎
CWE-25: Path Traversal: '/../filedir' 基礎
CWE-26: Path Traversal: '/dir/../filename' 基礎
CWE-27: Path Traversal: 'dir/../../filename' 基礎
CWE-28: Path Traversal: '..\filedir' 基礎
CWE-29: Path Traversal: '\..\filename' 基礎
CWE-30: Path Traversal: '\dir\..\filename' 基礎
CWE-31: Path Traversal: 'dir\..\..\filename' 基礎
CWE-32: Path Traversal: '...' (Triple Dot) 基礎
CWE-33: Path Traversal: '....' (Multiple Dot) 基礎
CWE-34: Path Traversal: '....//' 基礎
CWE-35: Path Traversal: '.../...//' 基礎
CWE-36: Absolute Path Traversal 基礎
CWE-37: Path Traversal: '/absolute/pathname/here' 基礎
CWE-38: Path Traversal: '\absolute\pathname\here' 基礎
CWE-39: Path Traversal: 'C:dirname' 基礎
CWE-40: Path Traversal: '\\UNC\share\name\' (Windows UNC Share) 基礎
CWE-41: Improper Resolution of Path Equivalence 基礎
CWE-42: Path Equivalence: 'filename.' (Trailing Dot) 基礎
CWE-43: Path Equivalence: 'filename....' (Multiple Trailing Dot) 基礎
CWE-44: Path Equivalence: 'file.name' (Internal Dot) 基礎
CWE-45: Path Equivalence: 'file...name' (Multiple Internal Dot) 基礎
CWE-46: Path Equivalence: 'filename ' (Trailing Space) 基礎
CWE-47: Path Equivalence: ' filename' (Leading Space) 基礎
CWE-48: Path Equivalence: 'file name' (Internal Whitespace) 基礎
CWE-49: Path Equivalence: 'filename/' (Trailing Slash) 基礎
CWE-50: Path Equivalence: '//multiple/leading/slash' 基礎
CWE-51: Path Equivalence: '/multiple//internal/slash' 基礎
CWE-52: Path Equivalence: '/multiple/trailing/slash//' 基礎
CWE-53: Path Equivalence: '\multiple\\internal\backslash' 基礎
CWE-54: Path Equivalence: 'filedir\' (Trailing Backslash) 基礎
CWE-55: Path Equivalence: '/./' (Single Dot Directory) 基礎
CWE-56: Path Equivalence: 'filedir*' (Wildcard) 基礎
CWE-57: Path Equivalence: 'fakedir/../realdir/filename' 基礎
CWE-58: Path Equivalence: Windows 8.3 Filename 基礎
CWE-59: Improper Link Resolution Before File Access 基礎
CWE-61: UNIX Symbolic Link (Symlink) Following 基礎
CWE-62: UNIX Hard Link 基礎
CWE-64: Windows Shortcut Following (.LNK) 基礎
CWE-65: Windows Hard Link 基礎
CWE-66: Improper Handling of File Names that Identify Virtual Resources 基礎
CWE-67: Improper Handling of Windows Device Names 基礎
CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream 基礎
CWE-72: Improper Handling of Apple HFS+ Alternate Data Stream Path 基礎
CWE-1407: Weaknesses in this category are related to improper neutralization.
CWE-116: Improper Encoding or Escaping of Output 基礎
CWE-117: Improper Output Neutralization for Logs 基礎
CWE-130: Improper Handling of Length Parameter Inconsistency 基礎
CWE-138: Improper Neutralization of Special Elements 基礎
CWE-140: Improper Neutralization of Delimiters 基礎
CWE-141: Improper Neutralization of Parameter/Argument Delimiters 基礎
CWE-142: Improper Neutralization of Value Delimiters 基礎
CWE-143: Improper Neutralization of Record Delimiters 基礎
CWE-144: Improper Neutralization of Line Delimiters 基礎
CWE-145: Improper Neutralization of Section Delimiters 基礎
CWE-146: Improper Neutralization of Expression/Command Delimiters 基礎
CWE-147: Improper Neutralization of Input Terminators 基礎
CWE-148: Improper Neutralization of Input Leaders 基礎
CWE-149: Improper Neutralization of Quoting Syntax 基礎
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences 基礎
CWE-151: Improper Neutralization of Comment Delimiters 基礎
CWE-152: Improper Neutralization of Macro Symbols 基礎
CWE-153: Improper Neutralization of Substitution Characters 基礎
CWE-154: Improper Neutralization of Variable Name Delimiters 基礎
CWE-155: Improper Neutralization of Wildcards or Matching Symbols 基礎
CWE-156: Improper Neutralization of Whitespace 基礎
CWE-157: Failure to Sanitize Paired Delimiters 基礎
CWE-158: Improper Neutralization of Null Byte or NUL Character 基礎
CWE-159: Improper Handling of Invalid Use of Special Elements 基礎
CWE-160: Improper Neutralization of Leading Special Elements 基礎
CWE-161: Improper Neutralization of Multiple Leading Special Elements 基礎
CWE-162: Improper Neutralization of Trailing Special Elements 基礎
CWE-163: Improper Neutralization of Multiple Trailing Special Elements 基礎
CWE-164: Improper Neutralization of Internal Special Elements 基礎
CWE-165: Improper Neutralization of Multiple Internal Special Elements 基礎
CWE-166: Improper Handling of Missing Special Element 基礎
CWE-167: Improper Handling of Additional Special Element 基礎
CWE-168: Improper Handling of Inconsistent Special Elements 基礎
CWE-170: Improper Null Termination 基礎
CWE-172: Improper Encoding or Decoding of Data 基礎
CWE-173: Improper Handling of Alternate Encoding 基礎
CWE-174: Double Decoding of the Same Data 基礎
CWE-175: Improper Handling of Mixed Encoding 基礎
CWE-176: Improper Handling of Unicode Encoding 基礎
CWE-177: Improper Handling of URL Encoding (Hex Encoding) 基礎
CWE-228: Improper Handling of Syntactically Invalid Structure 基礎
CWE-229: Improper Handling of Values 基礎
CWE-230: Improper Handling of Missing Values 基礎
CWE-231: Improper Handling of Extra Values 基礎
CWE-232: Improper Handling of Undefined Values 基礎
CWE-233: Improper Handling of Parameters 基礎
CWE-234: Failure to Handle Missing Parameter 基礎
CWE-235: Improper Handling of Extra Parameters 基礎
CWE-236: Improper Handling of Undefined Parameters 基礎
CWE-237: Improper Handling of Structural Elements 基礎
CWE-238: Improper Handling of Incomplete Structural Elements 基礎
CWE-239: Failure to Handle Incomplete Element 基礎
CWE-240: Improper Handling of Inconsistent Structural Elements 基礎
CWE-241: Improper Handling of Unexpected Data Type 基礎
CWE-463: Deletion of Data Structure Sentinel 基礎
CWE-464: Addition of Data Structure Sentinel 基礎
CWE-626: Null Byte Interaction Error (Poison Null Byte) 基礎
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax 基礎
CWE-707: Improper Neutralization 基礎
CWE-790: Improper Filtering of Special Elements 基礎
CWE-791: Incomplete Filtering of Special Elements 基礎
CWE-792: Incomplete Filtering of One or More Instances of Special Elements 基礎
CWE-793: Only Filtering One Instance of a Special Element 基礎
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements 基礎
CWE-795: Only Filtering Special Elements at a Specified Location 基礎
CWE-796: Only Filtering Special Elements Relative to a Marker 基礎
CWE-797: Only Filtering Special Elements at an Absolute Position 基礎
CWE-838: Inappropriate Encoding for Output Context 基礎
CWE-1409: Weaknesses in this category are related to injection.
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 基礎
CWE-75: Failure to Sanitize Special Elements into a Different Plane 基礎
CWE-76: Improper Neutralization of Equivalent Special Elements 基礎
CWE-77: Improper Neutralization of Special Elements used in a Command 基礎
CWE-78: Improper Neutralization of Special Elements used in an OS Command 基礎
CWE-79: Improper Neutralization of Input During Web Page Generation 基礎
", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page 基礎
CWE-81: Improper Neutralization of Script in an Error Message Web Page 基礎
CWE-82: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page 基礎
CWE-83: Improper Neutralization of Script in Attributes in a Web Page 基礎
CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page 基礎
CWE-85: Doubled Character XSS Manipulations 基礎
CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages 基礎
CWE-87: Improper Neutralization of Alternate XSS Syntax 基礎
CWE-88: Improper Neutralization of Argument Delimiters in a Command 基礎
CWE-89: Improper Neutralization of Special Elements used in an SQL Command 基礎
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 基礎
CWE-91: XML Injection 基礎
CWE-93: Improper Neutralization of CRLF Sequences 基礎
CWE-94: Improper Control of Generation of Code 基礎
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code 基礎
CWE-96: Improper Neutralization of Directives in Statically Saved Code 基礎
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 基礎
CWE-99: Improper Control of Resource Identifiers 基礎
CWE-102: Struts: Duplicate Validation Forms 基礎
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 基礎
CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input 基礎
CWE-621: Variable Extraction Error 基礎
CWE-624: Executable Regular Expression Error 基礎
CWE-627: Dynamic Variable Evaluation 基礎
CWE-641: Improper Restriction of Names for Files and Other Resources 基礎
CWE-643: Improper Neutralization of Data within XPath Expressions 基礎
CWE-652: Improper Neutralization of Data within XQuery Expressions 基礎
CWE-692: Incomplete Denylist to Cross-Site Scripting 基礎
CWE-694: Use of Multiple Resources with Duplicate Identifier 基礎
CWE-914: Improper Control of Dynamically-Identified Variables 基礎
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement 基礎
CWE-943: Improper Neutralization of Special Elements in Data Query Logic 基礎
CWE-1236: Improper Neutralization of Formula Elements in a CSV File 基礎
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine 基礎
CWE-1426: Improper Validation of Generative AI Output 基礎
CWE-1427: Improper Neutralization of Input Used for LLM Prompting 基礎
CWE-1410: Weaknesses in this category are related to insufficient control flow management.
CWE-179: Incorrect Behavior Order: Early Validation 基礎
CWE-180: Incorrect Behavior Order: Validate Before Canonicalize 基礎
CWE-181: Incorrect Behavior Order: Validate Before Filter 基礎
CWE-248: Uncaught Exception 基礎
CWE-382: J2EE Bad Practices: Use of System.exit() 基礎
CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference 基礎
CWE-396: Declaration of Catch for Generic Exception 基礎
CWE-397: Declaration of Throws for Generic Exception 基礎
CWE-408: Incorrect Behavior Order: Early Amplification 基礎
CWE-430: Deployment of Wrong Handler 基礎
CWE-431: Missing Handler 基礎
CWE-455: Non-exit on Failed Initialization 基礎
CWE-480: Use of Incorrect Operator 基礎
CWE-481: Assigning instead of Comparing 基礎
CWE-482: Comparing instead of Assigning 基礎
CWE-483: Incorrect Block Delimitation 基礎
CWE-584: Return Inside Finally Block 基礎
CWE-600: Uncaught Exception in Servlet 基礎
CWE-617: Reachable Assertion 基礎
CWE-670: Always-Incorrect Control Flow Implementation 基礎
CWE-674: Uncontrolled Recursion 基礎
CWE-691: Insufficient Control Flow Management 基礎
CWE-696: Incorrect Behavior Order 基礎
CWE-698: Execution After Redirect (EAR) 基礎
CWE-705: Incorrect Control Flow Scoping 基礎
CWE-768: Incorrect Short Circuit Evaluation 基礎
CWE-783: Operator Precedence Logic Error 基礎
CWE-799: Improper Control of Interaction Frequency 基礎
CWE-834: Excessive Iteration 基礎
CWE-835: Loop with Unreachable Exit Condition 基礎
CWE-837: Improper Enforcement of a Single, Unique Action 基礎
CWE-841: Improper Enforcement of Behavioral Workflow 基礎
CWE-1190: DMA Device Enabled Too Early in Boot Phase 基礎
CWE-1193: Power-On of Untrusted Execution Core Before Enabling Fabric Access Control 基礎
CWE-1265: Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls 基礎
CWE-1280: Access Control Check Implemented After Asset is Accessed 基礎
CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior 基礎
CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context 基礎
CWE-1399: Weaknesses in this category are related to memory safety.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer 基礎
CWE-120: Buffer Copy without Checking Size of Input 基礎
CWE-121: Stack-based Buffer Overflow 基礎
CWE-122: Heap-based Buffer Overflow 基礎
CWE-123: Write-what-where Condition 基礎
CWE-124: Buffer Underwrite 基礎
CWE-125: Out-of-bounds Read 基礎
CWE-126: Buffer Over-read 基礎
CWE-127: Buffer Under-read 基礎
CWE-129: Improper Validation of Array Index 基礎
CWE-131: Incorrect Calculation of Buffer Size 基礎
CWE-134: Use of Externally-Controlled Format String 基礎
CWE-188: Reliance on Data/Memory Layout 基礎
CWE-198: Use of Incorrect Byte Ordering 基礎
CWE-244: Improper Clearing of Heap Memory Before Release 基礎
CWE-401: Missing Release of Memory after Effective Lifetime 基礎
CWE-415: Double Free 基礎
CWE-416: Use After Free 基礎
CWE-466: Return of Pointer Value Outside of Expected Range 基礎
CWE-562: Return of Stack Variable Address 基礎
CWE-587: Assignment of a Fixed Address to a Pointer 基礎
CWE-590: Free of Memory not on the Heap 基礎
CWE-680: Integer Overflow to Buffer Overflow 基礎
CWE-690: Unchecked Return Value to NULL Pointer Dereference 基礎
CWE-761: Free of Pointer not at Start of Buffer 基礎
CWE-762: Mismatched Memory Management Routines 基礎
CWE-763: Release of Invalid Pointer or Reference 基礎
CWE-786: Access of Memory Location Before Start of Buffer 基礎
CWE-787: Out-of-bounds Write 基礎
CWE-788: Access of Memory Location After End of Buffer 基礎
CWE-789: Memory Allocation with Excessive Size Value 基礎
CWE-805: Buffer Access with Incorrect Length Value 基礎
CWE-806: Buffer Access Using Size of Source Buffer 基礎
CWE-822: Untrusted Pointer Dereference 基礎
CWE-823: Use of Out-of-range Pointer Offset 基礎
CWE-824: Access of Uninitialized Pointer 基礎
CWE-825: Expired Pointer Dereference 基礎
CWE-1412: Weaknesses in this category are related to poor coding practices.
CWE-11: ASP.NET Misconfiguration: Creating Debug Binary 基礎
CWE-103: Struts: Incomplete validate() Method Definition 基礎
CWE-104: Struts: Form Bean Does Not Extend Validation Class 基礎
CWE-107: Struts: Unused Validation Form 基礎
CWE-110: Struts: Validator Without Form Field 基礎
CWE-111: Direct Use of Unsafe JNI 基礎
CWE-242: Use of Inherently Dangerous Function 基礎
CWE-245: J2EE Bad Practices: Direct Management of Connections 基礎
CWE-246: J2EE Bad Practices: Direct Use of Sockets 基礎
CWE-253: Incorrect Check of Function Return Value 基礎
CWE-358: Improperly Implemented Security Check for Standard 基礎
CWE-383: J2EE Bad Practices: Direct Use of Threads 基礎
CWE-392: Missing Report of Error Condition 基礎
CWE-393: Return of Wrong Status Code 基礎
CWE-440: Expected Behavior Violation 基礎
CWE-446: UI Discrepancy for Security Feature 基礎
CWE-448: Obsolete Feature in UI 基礎
CWE-449: The UI Performs the Wrong Action 基礎
CWE-451: User Interface (UI) Misrepresentation of Critical Information 基礎
CWE-462: Duplicate Key in Associative List (Alist) 基礎
CWE-474: Use of Function with Inconsistent Implementations 基礎
CWE-475: Undefined Behavior for Input to API 基礎
CWE-476: NULL Pointer Dereference 基礎
CWE-477: Use of Obsolete Function 基礎
CWE-484: Omitted Break Statement in Switch 基礎
CWE-489: Active Debug Code 基礎
CWE-506: Embedded Malicious Code 基礎
CWE-507: Trojan Horse 基礎
CWE-508: Non-Replicating Malicious Code 基礎
CWE-509: Replicating Malicious Code (Virus or Worm) 基礎
CWE-510: Trapdoor 基礎
CWE-511: Logic/Time Bomb 基礎
CWE-512: Spyware 基礎
CWE-546: Suspicious Comment 基礎
CWE-547: Use of Hard-coded, Security-relevant Constants 基礎
CWE-560: Use of umask() with chmod-style Argument 基礎
CWE-561: Dead Code 基礎
CWE-563: Assignment to Variable without Use 基礎
CWE-570: Expression is Always False 基礎
CWE-571: Expression is Always True 基礎
CWE-573: Improper Following of Specification by Caller 基礎
CWE-575: EJB Bad Practices: Use of AWT Swing 基礎
CWE-576: EJB Bad Practices: Use of Java I/O 基礎
CWE-577: EJB Bad Practices: Use of Sockets 基礎
CWE-578: EJB Bad Practices: Use of Class Loader 基礎
CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session 基礎
CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined 基礎
CWE-585: Empty Synchronized Block 基礎
CWE-586: Explicit Call to Finalize() 基礎
CWE-589: Call to Non-ubiquitous API 基礎
CWE-594: J2EE Framework: Saving Unserializable Objects to Disk 基礎
CWE-605: Multiple Binds to the Same Port 基礎
CWE-628: Function Call with Incorrectly Specified Arguments 基礎
CWE-675: Multiple Operations on Resource in Single-Operation Context 基礎
CWE-676: Use of Potentially Dangerous Function 基礎
CWE-683: Function Call With Incorrect Order of Arguments 基礎
CWE-684: Incorrect Provision of Specified Functionality 基礎
CWE-685: Function Call With Incorrect Number of Arguments 基礎
CWE-686: Function Call With Incorrect Argument Type 基礎
CWE-687: Function Call With Incorrectly Specified Argument Value 基礎
CWE-688: Function Call With Incorrect Variable or Reference as Argument 基礎
CWE-695: Use of Low-Level Functionality 基礎
CWE-710: Improper Adherence to Coding Standards 基礎
CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior 基礎
CWE-766: Critical Data Element Declared Public 基礎
CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer 基礎
CWE-912: Hidden Functionality 基礎
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User 基礎
CWE-1041: Use of Redundant Code 基礎
CWE-1043: Data Element Aggregating an Excessively Large Number of Non-Primitive Elements 基礎
CWE-1044: Architecture with Number of Horizontal Layers Outside of Expected Range 基礎
CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor 基礎
CWE-1047: Modules with Circular Dependencies 基礎
CWE-1048: Invokable Control Element with Large Number of Outward Calls 基礎
CWE-1053: Missing Documentation for Design 基礎
CWE-1054: Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer 基礎
CWE-1055: Multiple Inheritance from Concrete Classes 基礎
CWE-1056: Invokable Control Element with Variadic Parameters 基礎
CWE-1057: Data Access Operations Outside of Expected Data Manager Component 基礎
CWE-1059: Insufficient Technical Documentation 基礎
CWE-1060: Excessive Number of Inefficient Server-Side Data Accesses 基礎
CWE-1061: Insufficient Encapsulation 基礎
CWE-1062: Parent Class with References to Child Class 基礎
CWE-1064: Invokable Control Element with Signature Containing an Excessive Number of Parameters 基礎
CWE-1065: Runtime Resource Management Control Element in a Component Built to Run on Application Servers 基礎
CWE-1066: Missing Serialization Control Element 基礎
CWE-1068: Inconsistency Between Implementation and Documented Design 基礎
CWE-1069: Empty Exception Block 基礎
CWE-1070: Serializable Data Element Containing non-Serializable Item Elements 基礎
CWE-1071: Empty Code Block 基礎
CWE-1074: Class with Excessively Deep Inheritance 基礎
CWE-1075: Unconditional Control Flow Transfer outside of Switch Block 基礎
CWE-1076: Insufficient Adherence to Expected Conventions 基礎
CWE-1078: Inappropriate Source Code Style or Formatting 基礎
CWE-1079: Parent Class without Virtual Destructor Method 基礎
CWE-1080: Source Code File with Excessive Number of Lines of Code 基礎
CWE-1082: Class Instance Self Destruction Control Element 基礎
CWE-1083: Data Access from Outside Expected Data Manager Component 基礎
CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code 基礎
CWE-1086: Class with Excessive Number of Child Classes 基礎
CWE-1087: Class with Virtual Method without a Virtual Destructor 基礎
CWE-1090: Method Containing Access of a Member Element from Another Class 基礎
CWE-1092: Use of Same Invokable Control Element in Multiple Architectural Layers 基礎
CWE-1093: Excessively Complex Data Representation 基礎
CWE-1095: Loop Condition Value Update within the Loop 基礎
CWE-1097: Persistent Storable Data Element without Associated Comparison Control Element 基礎
CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element 基礎
CWE-1099: Inconsistent Naming Conventions for Identifiers 基礎
CWE-1100: Insufficient Isolation of System-Dependent Functions 基礎
CWE-1101: Reliance on Runtime Component in Generated Code 基礎
CWE-1102: Reliance on Machine-Dependent Data Representation 基礎
CWE-1103: Use of Platform-Dependent Third Party Components 基礎
CWE-1105: Insufficient Encapsulation of Machine-Dependent Functionality 基礎
CWE-1106: Insufficient Use of Symbolic Constants 基礎
CWE-1107: Insufficient Isolation of Symbolic Constant Definitions 基礎
CWE-1108: Excessive Reliance on Global Variables 基礎
CWE-1109: Use of Same Variable for Multiple Purposes 基礎
CWE-1110: Incomplete Design Documentation 基礎
CWE-1111: Incomplete I/O Documentation 基礎
CWE-1112: Incomplete Documentation of Program Execution 基礎
CWE-1113: Inappropriate Comment Style 基礎
CWE-1114: Inappropriate Whitespace Style 基礎
CWE-1115: Source Code Element without Standard Prologue 基礎
CWE-1116: Inaccurate Source Code Comments 基礎
CWE-1117: Callable with Insufficient Behavioral Summary 基礎
CWE-1118: Insufficient Documentation of Error Handling Techniques 基礎
CWE-1119: Excessive Use of Unconditional Branching 基礎
CWE-1120: Excessive Code Complexity 基礎
CWE-1121: Excessive McCabe Cyclomatic Complexity 基礎
CWE-1122: Excessive Halstead Complexity 基礎
CWE-1123: Excessive Use of Self-Modifying Code 基礎
CWE-1124: Excessively Deep Nesting 基礎
CWE-1125: Excessive Attack Surface 基礎
CWE-1126: Declaration of Variable with Unnecessarily Wide Scope 基礎
CWE-1127: Compilation with Insufficient Warnings or Errors 基礎
CWE-1164: Irrelevant Code 基礎
CWE-1177: Use of Prohibited Code 基礎
CWE-1209: Failure to Disable Reserved Bits 基礎
CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic 基礎
CWE-1341: Multiple Releases of Same Resource or Handle 基礎
CWE-1357: Reliance on Insufficiently Trustworthy Component 基礎
CWE-1434: Insecure Setting of Generative AI/ML Model Inference Parameters 基礎
CWE-1413: Weaknesses in this category are related to protection mechanism failure.
CWE-182: Collapse of Data into Unsafe Value 基礎
CWE-184: Incomplete List of Disallowed Inputs 基礎
CWE-222: Truncation of Security-relevant Information 基礎
CWE-223: Omission of Security-relevant Information 基礎
CWE-224: Obscured Security-relevant Information by Alternate Name 基礎
CWE-356: Missing User Interaction for Potentially Unsafe Action 基礎
CWE-357: Insufficient UI Warning of Dangerous Operations 基礎
CWE-450: Multiple Interpretations of UI Input 基礎
CWE-602: Client-Side Enforcement of Server-Side Security 基礎
CWE-693: Protection Mechanism Failure 基礎
CWE-757: Selection of Less-Secure Algorithm During Negotiation 基礎
CWE-778: Insufficient Logging 基礎
CWE-807: Reliance on Untrusted Inputs in a Security Decision 基礎
CWE-1039: Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism 基礎
CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications 基礎
CWE-1253: Incorrect Selection of Fuse Values 基礎
CWE-1269: Product Released in Non-Release Configuration 基礎
CWE-1278: Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques 基礎
CWE-1291: Public Key Re-Use for Signing both Debug and Production Code 基礎
CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses 基礎
CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI) 基礎
CWE-1326: Missing Immutable Root of Trust in Hardware 基礎
CWE-1338: Improper Protections Against Hardware Overheating 基礎
CWE-1429: Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface 基礎
CWE-1416: Weaknesses in this category are related to resource lifecycle management.
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program 基礎
CWE-118: Incorrect Access of Indexable Resource 基礎
CWE-178: Improper Handling of Case Sensitivity 基礎
CWE-192: Integer Coercion Error 基礎
CWE-194: Unexpected Sign Extension 基礎
CWE-195: Signed to Unsigned Conversion Error 基礎
CWE-196: Unsigned to Signed Conversion Error 基礎
CWE-197: Numeric Truncation Error 基礎
CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer 基礎
CWE-221: Information Loss or Omission 基礎
CWE-226: Sensitive Information in Resource Not Removed Before Reuse 基礎
CWE-243: Creation of chroot Jail Without Changing Working Directory 基礎
CWE-372: Incomplete Internal State Distinction 基礎
CWE-386: Symbolic Name not Mapping to Correct Object 基礎
CWE-400: Uncontrolled Resource Consumption 基礎
CWE-404: Improper Resource Shutdown or Release 基礎
CWE-405: Asymmetric Resource Consumption (Amplification) 基礎
CWE-406: Insufficient Control of Network Message Volume (Network Amplification) 基礎
CWE-407: Inefficient Algorithmic Complexity 基礎
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) 基礎
CWE-410: Insufficient Resource Pool 基礎
CWE-434: Unrestricted Upload of File with Dangerous Type 基礎
CWE-453: Insecure Default Variable Initialization 基礎
CWE-454: External Initialization of Trusted Variables or Data Stores 基礎
CWE-456: Missing Initialization of a Variable 基礎
CWE-457: Use of Uninitialized Variable 基礎
CWE-459: Incomplete Cleanup 基礎
CWE-460: Improper Cleanup on Thrown Exception 基礎
CWE-471: Modification of Assumed-Immutable Data (MAID) 基礎
CWE-487: Reliance on Package-level Scope 基礎
CWE-495: Private Data Structure Returned From A Public Method 基礎
CWE-496: Public Data Assigned to Private Array-Typed Field 基礎
CWE-501: Trust Boundary Violation 基礎
CWE-568: finalize() Method Without super.finalize() 基礎
CWE-580: clone() Method Without super.clone() 基礎
CWE-588: Attempt to Access Child of a Non-structure Pointer 基礎
CWE-607: Public Static Final Field References Mutable Object 基礎
CWE-610: Externally Controlled Reference to a Resource in Another Sphere 基礎
CWE-618: Exposed Unsafe ActiveX Method 基礎
CWE-662: Improper Synchronization 基礎
CWE-664: Improper Control of a Resource Through its Lifetime 基礎
CWE-665: Improper Initialization 基礎
CWE-666: Operation on Resource in Wrong Phase of Lifetime 基礎
CWE-669: Incorrect Resource Transfer Between Spheres 基礎
CWE-673: External Influence of Sphere Definition 基礎
CWE-681: Incorrect Conversion between Numeric Types 基礎
CWE-704: Incorrect Type Conversion or Cast 基礎
CWE-706: Use of Incorrectly-Resolved Name or Reference 基礎
CWE-749: Exposed Dangerous Method or Function 基礎
CWE-770: Allocation of Resources Without Limits or Throttling 基礎
CWE-771: Missing Reference to Active Allocated Resource 基礎
CWE-772: Missing Release of Resource after Effective Lifetime 基礎
CWE-773: Missing Reference to Active File Descriptor or Handle 基礎
CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling 基礎
CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime 基礎
CWE-776: Improper Restriction of Recursive Entity References in DTDs 基礎
CWE-779: Logging of Excessive Data 基礎
CWE-782: Exposed IOCTL with Insufficient Access Control 基礎
CWE-827: Improper Control of Document Type Definition 基礎
CWE-829: Inclusion of Functionality from Untrusted Control Sphere 基礎
CWE-830: Inclusion of Web Functionality from an Untrusted Source 基礎
CWE-843: Access of Resource Using Incompatible Type 基礎
CWE-908: Use of Uninitialized Resource 基礎
CWE-909: Missing Initialization of Resource 基礎
CWE-911: Improper Update of Reference Count 基礎
CWE-913: Improper Control of Dynamically-Managed Code Resources 基礎
CWE-920: Improper Restriction of Power Consumption 基礎
CWE-922: Insecure Storage of Sensitive Information 基礎
CWE-1042: Static Member Data Element outside of a Singleton Class Element 基礎
CWE-1046: Creation of Immutable Text Using String Concatenation 基礎
CWE-1049: Excessive Data Query Operations in a Large Data Table 基礎
CWE-1050: Excessive Platform Resource Consumption within a Loop 基礎
CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data 基礎
CWE-1052: Excessive Use of Hard-Coded Literals in Initialization 基礎
CWE-1063: Creation of Class Instance within a Static Code Block 基礎
CWE-1067: Excessive Execution of Sequential Searches of Data Resource 基礎
CWE-1072: Data Resource Access without Use of Connection Pooling 基礎
CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses 基礎
CWE-1084: Invokable Control Element with Excessive File or Data Access Operations 基礎
CWE-1089: Large Data Table with Excessive Number of Indices 基礎
CWE-1091: Use of Object without Invoking Destructor Method 基礎
CWE-1094: Excessive Index Range Scan for a Data Resource 基礎
CWE-1176: Inefficient CPU Computation 基礎
CWE-1188: Initialization of a Resource with an Insecure Default 基礎
CWE-1221: Incorrect Register Defaults or Module Parameters 基礎
CWE-1229: Creation of Emergent Resource 基礎
CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations 基礎
CWE-1239: Improper Zeroization of Hardware Register 基礎
CWE-1246: Improper Write Handling in Limited-write Non-Volatile Memories 基礎
CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared State 基礎
CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information 基礎
CWE-1266: Improper Scrubbing of Sensitive Data from Decommissioned Device 基礎
CWE-1271: Uninitialized Value on Reset for Registers Holding Security Settings 基礎
CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition 基礎
CWE-1279: Cryptographic Operations are Run Before Supporting Units are Ready 基礎
CWE-1301: Insufficient or Incomplete Data Removal within Hardware Component 基礎
CWE-1325: Improperly Controlled Sequential Memory Allocation 基礎
CWE-1330: Remanent Data Readable after Memory Erase 基礎
CWE-1333: Inefficient Regular Expression Complexity 基礎
CWE-1342: Information Exposure through Microarchitectural State after Transient Execution 基礎
CWE-1386: Insecure Operation on Windows Junction / Mount Point 基礎
CWE-1389: Incorrect Parsing of Numbers with Different Radices 基礎
CWE-1419: Incorrect Initialization of Resource 基礎
CWE-1420: Exposure of Sensitive Information during Transient Execution 基礎
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution 基礎
CWE-1422: Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution 基礎
CWE-1423: Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution 基礎
CWE-1417: Weaknesses in this category are related to sensitive information exposure.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor 基礎
CWE-201: Insertion of Sensitive Information Into Sent Data 基礎
CWE-203: Observable Discrepancy 基礎
CWE-204: Observable Response Discrepancy 基礎
CWE-205: Observable Behavioral Discrepancy 基礎
CWE-206: Observable Internal Behavioral Discrepancy 基礎
CWE-207: Observable Behavioral Discrepancy With Equivalent Products 基礎
CWE-208: Observable Timing Discrepancy 基礎
CWE-209: Generation of Error Message Containing Sensitive Information 基礎
CWE-210: Self-generated Error Message Containing Sensitive Information 基礎
CWE-211: Externally-Generated Error Message Containing Sensitive Information 基礎
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies 基礎
CWE-214: Invocation of Process Using Visible Sensitive Information 基礎
CWE-215: Insertion of Sensitive Information Into Debugging Code 基礎
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor 基礎
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere 基礎
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable 基礎
CWE-531: Inclusion of Sensitive Information in Test Code 基礎
CWE-532: Insertion of Sensitive Information into Log File 基礎
CWE-535: Exposure of Information Through Shell Error Message 基礎
CWE-536: Servlet Runtime Error Message Containing Sensitive Information 基礎
CWE-537: Java Runtime Error Message Containing Sensitive Information 基礎
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory 基礎
CWE-540: Inclusion of Sensitive Information in Source Code 基礎
CWE-541: Inclusion of Sensitive Information in an Include File 基礎
CWE-548: Exposure of Information Through Directory Listing 基礎
CWE-550: Server-generated Error Message Containing Sensitive Information 基礎
CWE-598: Use of HTTP Request With Sensitive Query String 基礎
CWE-615: Inclusion of Sensitive Information in Source Code Comments 基礎
CWE-651: Exposure of WSDL File Containing Sensitive Information 基礎
CWE-1254: Incorrect Comparison Logic Granularity 基礎
CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks 基礎
CWE-1273: Device Unlock Credential Sharing 基礎
CWE-1295: Debug Messages Revealing Unnecessary Information 基礎
CWE-1300: Improper Protection of Physical Side Channels 基礎
CWE-1431: Driving Intermediate Cryptographic State/Results to Hardware Module Outputs 基礎

CWE 檢視資訊

漏洞對應備注

理由說明 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
備註 : Use this View or other Views to search and navigate for the appropriate weakness.

備注

This view is different than the software development view (CWE-699) because this view is expected to include all weaknesses regardless of abstraction, while view 699 uses a largely-fixed Base level of abstraction related only to software weaknesses. It is different from the Research view (CWE-1000) because while comprehensive for all weaknesses, the view uses a deep hierarchical structure and excludes categories.

受眾

相關方 描述
Academic Researchers Researchers can use this view to evaluate the breadth and depth of software assurance with respect to mitigating and managing weaknesses before they become vulnerabilities.

提交

名稱 機構 日期 發布日期 Version
CWE Content Team MITRE 2023-04-25 +00:00 2023-04-23 +00:00 4.11

修改記錄

名稱 機構 日期 備註
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
cvefind.com 上呈現的資訊來自多個精心挑選的參考來源。CVE 資料由 MITRE Corporation 和 國家漏洞資料庫（NVD）提供。已知被利用漏洞（KEV）目錄來自 網路安全暨基礎設施安全局（CISA），而 EPSS 評分來自 FIRST.org。此外，軟體弱點（CWE）和常見攻擊模式（CAPEC）的資料由 MITRE Corporation 維護，硬軟體配置（CPE）資訊由 NVD 提供。