繁體中文

CWE-1409 類別詳細資料

CWE-1409

Comprehensive Categorization: Injection
2023-04-23 +00:00
Incomplete
2024-11-19 +00:00
CWE Mitre.org
指定 CWE 通知
掌握特定 CWE 的任何變更。
管理通知

名稱: Comprehensive Categorization: Injection

Weaknesses in this category are related to injection.

CWE 成員列表

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 基礎

CWE-75: Failure to Sanitize Special Elements into a Different Plane 基礎

CWE-76: Improper Neutralization of Equivalent Special Elements 基礎

CWE-77: Improper Neutralization of Special Elements used in a Command 基礎

CWE-78: Improper Neutralization of Special Elements used in an OS Command 基礎

CWE-79: Improper Neutralization of Input During Web Page Generation 基礎

", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page 基礎

CWE-81: Improper Neutralization of Script in an Error Message Web Page 基礎

CWE-82: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page 基礎

CWE-83: Improper Neutralization of Script in Attributes in a Web Page 基礎

CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page 基礎

CWE-85: Doubled Character XSS Manipulations 基礎

CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages 基礎

CWE-87: Improper Neutralization of Alternate XSS Syntax 基礎

CWE-88: Improper Neutralization of Argument Delimiters in a Command 基礎

CWE-89: Improper Neutralization of Special Elements used in an SQL Command 基礎

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 基礎

CWE-91: XML Injection 基礎

CWE-93: Improper Neutralization of CRLF Sequences 基礎

CWE-94: Improper Control of Generation of Code 基礎

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code 基礎

CWE-96: Improper Neutralization of Directives in Statically Saved Code 基礎

CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 基礎

CWE-99: Improper Control of Resource Identifiers 基礎

CWE-102: Struts: Duplicate Validation Forms 基礎

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 基礎

CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input 基礎

CWE-621: Variable Extraction Error 基礎

CWE-624: Executable Regular Expression Error 基礎

CWE-627: Dynamic Variable Evaluation 基礎

CWE-641: Improper Restriction of Names for Files and Other Resources 基礎

CWE-643: Improper Neutralization of Data within XPath Expressions 基礎

CWE-652: Improper Neutralization of Data within XQuery Expressions 基礎

CWE-692: Incomplete Denylist to Cross-Site Scripting 基礎

CWE-694: Use of Multiple Resources with Duplicate Identifier 基礎

CWE-914: Improper Control of Dynamically-Identified Variables 基礎

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement 基礎

CWE-943: Improper Neutralization of Special Elements in Data Query Logic 基礎

CWE-1236: Improper Neutralization of Formula Elements in a CSV File 基礎

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine 基礎

CWE-1426: Improper Validation of Generative AI Output 基礎

CWE-1427: Improper Neutralization of Input Used for LLM Prompting 基礎

CWE 資訊

漏洞對應備注

理由說明 : This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].
備註 : See member weaknesses of this category.

提交

名稱 機構 日期 發布日期 Version
CWE Content Team MITRE 2023-04-25 +00:00 2023-04-23 +00:00 4.11

修改記錄

名稱 機構 日期 備註
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2024-07-16 +00:00 updated Relationships
CWE Content Team MITRE 2024-11-19 +00:00 updated Relationships

參考資料

REF-1330

CVE --> CWE Mapping Guidance - Quick Tips
MITRE.
https://cwe.mitre.org/documents/cwe_usage/quick_tips.html

cvefind.com 上呈現的資訊來自多個精心挑選的參考來源。CVE 資料由 MITRE Corporation 和 國家漏洞資料庫（NVD）提供。已知被利用漏洞（KEV）目錄來自 網路安全暨基礎設施安全局（CISA），而 EPSS 評分來自 FIRST.org。此外，軟體弱點（CWE）和常見攻擊模式（CAPEC）的資料由 MITRE Corporation 維護，硬軟體配置（CPE）資訊由 NVD 提供。