繁體中文

CWE-1450 檢視詳細資料

CWE-1450

Weaknesses in OWASP Top Ten RC1 (2025)
2024-12-01 +00:00
Incomplete
Graph
CWE Mitre.org
指定 CWE 通知
掌握特定 CWE 的任何變更。
管理通知

名稱: Weaknesses in OWASP Top Ten RC1 (2025)

CWE entries in this view (graph) are associated with the first release candidate (RC1) of the OWASP Top Ten, as released in 2025.

CWE 成員

CWE-1436: Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2025.
CWE-1275: Sensitive Cookie with Improper SameSite Attribute 基礎
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor 基礎
CWE-201: Insertion of Sensitive Information Into Sent Data 基礎
CWE-219: Storage of File with Sensitive Data Under Web Root 基礎
CWE-22: Improper Limitation of a Pathname to a Restricted Directory 基礎
CWE-23: Relative Path Traversal 基礎
CWE-276: Incorrect Default Permissions 基礎
CWE-281: Improper Preservation of Permissions 基礎
CWE-282: Improper Ownership Management 基礎
CWE-283: Unverified Ownership 基礎
CWE-284: Improper Access Control 基礎
CWE-285: Improper Authorization 基礎
CWE-352: Cross-Site Request Forgery 基礎
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor 基礎
CWE-36: Absolute Path Traversal 基礎
CWE-377: DEPRECATED: Insecure Temporary File 基礎
CWE-379: Creation of Temporary File in Directory with Insecure Permissions 基礎
CWE-402: Transmission of Private Resources into a New Sphere 基礎
CWE-424: Improper Protection of Alternate Path 基礎
CWE-425: Direct Request 基礎
CWE-441: Unintended Proxy or Intermediary 基礎
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere 基礎
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory 基礎
CWE-540: Inclusion of Sensitive Information in Source Code 基礎
CWE-548: Exposure of Information Through Directory Listing 基礎
CWE-552: Files or Directories Accessible to External Parties 基礎
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key 基礎
CWE-59: Improper Link Resolution Before File Access 基礎
CWE-601: URL Redirection to Untrusted Site 基礎
CWE-61: UNIX Symbolic Link (Symlink) Following 基礎
CWE-615: Inclusion of Sensitive Information in Source Code Comments 基礎
CWE-639: Authorization Bypass Through User-Controlled Key 基礎
CWE-65: Windows Hard Link 基礎
CWE-668: Exposure of Resource to Wrong Sphere 基礎
CWE-732: Incorrect Permission Assignment for Critical Resource 基礎
CWE-749: Exposed Dangerous Method or Function 基礎
CWE-862: Missing Authorization 基礎
CWE-863: Incorrect Authorization 基礎
CWE-918: Server-Side Request Forgery 基礎
CWE-922: Insecure Storage of Sensitive Information 基礎
CWE-1439: Weaknesses in this category are related to the A04 category "Cryptographic Failures" in the OWASP Top Ten 2025.
CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation 基礎
CWE-1241: Use of Predictable Algorithm in Random Number Generator 基礎
CWE-261: Weak Encoding for Password 基礎
CWE-296: Improper Following of a Certificate's Chain of Trust 基礎
CWE-319: Cleartext Transmission of Sensitive Information 基礎
CWE-320: Key Management Errors 類別
CWE-321: Use of Hard-coded Cryptographic Key 基礎
CWE-322: Key Exchange without Entity Authentication 基礎
CWE-323: Reusing a Nonce, Key Pair in Encryption 基礎
CWE-324: Use of a Key Past its Expiration Date 基礎
CWE-325: Missing Cryptographic Step 基礎
CWE-326: Inadequate Encryption Strength 基礎
CWE-327: Use of a Broken or Risky Cryptographic Algorithm 基礎
CWE-328: Use of Weak Hash 基礎
CWE-329: Generation of Predictable IV with CBC Mode 基礎
CWE-330: Use of Insufficiently Random Values 基礎
CWE-331: Insufficient Entropy 基礎
CWE-332: Insufficient Entropy in PRNG 基礎
CWE-334: Small Space of Random Values 基礎
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 基礎
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) 基礎
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) 基礎
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 基礎
CWE-340: Generation of Predictable Numbers or Identifiers 基礎
CWE-342: Predictable Exact Value from Previous Values 基礎
CWE-347: Improper Verification of Cryptographic Signature 基礎
CWE-523: Unprotected Transport of Credentials 基礎
CWE-757: Selection of Less-Secure Algorithm During Negotiation 基礎
CWE-759: Use of a One-Way Hash without a Salt 基礎
CWE-760: Use of a One-Way Hash with a Predictable Salt 基礎
CWE-780: Use of RSA Algorithm without OAEP 基礎
CWE-916: Use of Password Hash With Insufficient Computational Effort 基礎
CWE-1440: Weaknesses in this category are related to the A05 category "Injection" in the OWASP Top Ten 2025.
CWE-103: Struts: Incomplete validate() Method Definition 基礎
CWE-104: Struts: Form Bean Does Not Extend Validation Class 基礎
CWE-112: Missing XML Validation 基礎
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 基礎
CWE-114: Process Control 基礎
CWE-115: Misinterpretation of Input 基礎
CWE-116: Improper Encoding or Escaping of Output 基礎
CWE-129: Improper Validation of Array Index 基礎
CWE-159: Improper Handling of Invalid Use of Special Elements 基礎
CWE-20: Improper Input Validation 基礎
CWE-470: Use of Externally-Controlled Input to Select Classes or Code 基礎
CWE-493: Critical Public Variable Without Final Modifier 基礎
CWE-500: Public Static Field Not Marked Final 基礎
CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input 基礎
CWE-610: Externally Controlled Reference to a Resource in Another Sphere 基礎
CWE-643: Improper Neutralization of Data within XPath Expressions 基礎
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax 基礎
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 基礎
CWE-76: Improper Neutralization of Equivalent Special Elements 基礎
CWE-77: Improper Neutralization of Special Elements used in a Command 基礎
CWE-78: Improper Neutralization of Special Elements used in an OS Command 基礎
CWE-79: Improper Neutralization of Input During Web Page Generation 基礎
", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page 基礎
CWE-83: Improper Neutralization of Script in Attributes in a Web Page 基礎
CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages 基礎
CWE-88: Improper Neutralization of Argument Delimiters in a Command 基礎
CWE-89: Improper Neutralization of Special Elements used in an SQL Command 基礎
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 基礎
CWE-91: XML Injection 基礎
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement 基礎
CWE-93: Improper Neutralization of CRLF Sequences 基礎
CWE-94: Improper Control of Generation of Code 基礎
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code 基礎
CWE-96: Improper Neutralization of Directives in Statically Saved Code 基礎
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 基礎
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program 基礎
CWE-99: Improper Control of Resource Identifiers 基礎
CWE-1441: Weaknesses in this category are related to the A06 category "Insecure Design" in the OWASP Top Ten 2025.
CWE-1021: Improper Restriction of Rendered UI Layers or Frames 基礎
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access 基礎
CWE-1125: Excessive Attack Surface 基礎
CWE-183: Permissive List of Allowed Inputs 基礎
CWE-256: Plaintext Storage of a Password 基礎
CWE-266: Incorrect Privilege Assignment 基礎
CWE-269: Improper Privilege Management 基礎
CWE-286: Incorrect User Management 基礎
CWE-311: Missing Encryption of Sensitive Data 基礎
CWE-312: Cleartext Storage of Sensitive Information 基礎
CWE-313: Cleartext Storage in a File or on Disk 基礎
CWE-316: Cleartext Storage of Sensitive Information in Memory 基礎
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 基礎
CWE-382: J2EE Bad Practices: Use of System.exit() 基礎
CWE-419: Unprotected Primary Channel 基礎
CWE-434: Unrestricted Upload of File with Dangerous Type 基礎
CWE-436: Interpretation Conflict 基礎
CWE-444: Inconsistent Interpretation of HTTP Requests 基礎
CWE-451: User Interface (UI) Misrepresentation of Critical Information 基礎
CWE-454: External Initialization of Trusted Variables or Data Stores 基礎
CWE-472: External Control of Assumed-Immutable Web Parameter 基礎
CWE-501: Trust Boundary Violation 基礎
CWE-522: Insufficiently Protected Credentials 基礎
CWE-525: Use of Web Browser Cache Containing Sensitive Information 基礎
CWE-539: Use of Persistent Cookies Containing Sensitive Information 基礎
CWE-598: Use of HTTP Request With Sensitive Query String 基礎
CWE-602: Client-Side Enforcement of Server-Side Security 基礎
CWE-628: Function Call with Incorrectly Specified Arguments 基礎
CWE-642: External Control of Critical State Data 基礎
CWE-646: Reliance on File Name or Extension of Externally-Supplied File 基礎
CWE-653: Improper Isolation or Compartmentalization 基礎
CWE-656: Reliance on Security Through Obscurity 基礎
CWE-657: Violation of Secure Design Principles 基礎
CWE-676: Use of Potentially Dangerous Function 基礎
CWE-693: Protection Mechanism Failure 基礎
CWE-73: External Control of File Name or Path 基礎
CWE-799: Improper Control of Interaction Frequency 基礎
CWE-807: Reliance on Untrusted Inputs in a Security Decision 基礎
CWE-841: Improper Enforcement of Behavioral Workflow 基礎
CWE-1442: Weaknesses in this category are related to the A07 category "Authentication Failures" in the OWASP Top Ten 2025.
CWE-1390: Weak Authentication 基礎
CWE-1391: Use of Weak Credentials 基礎
CWE-1392: Use of Default Credentials 基礎
CWE-1393: Use of Default Password 基礎
CWE-258: Empty Password in Configuration File 基礎
CWE-259: Use of Hard-coded Password 基礎
CWE-287: Improper Authentication 基礎
CWE-288: Authentication Bypass Using an Alternate Path or Channel 基礎
CWE-289: Authentication Bypass by Alternate Name 基礎
CWE-290: Authentication Bypass by Spoofing 基礎
CWE-291: Reliance on IP Address for Authentication 基礎
CWE-293: Using Referer Field for Authentication 基礎
CWE-294: Authentication Bypass by Capture-replay 基礎
CWE-295: Improper Certificate Validation 基礎
CWE-297: Improper Validation of Certificate with Host Mismatch 基礎
CWE-298: Improper Validation of Certificate Expiration 基礎
CWE-299: Improper Check for Certificate Revocation 基礎
CWE-300: Channel Accessible by Non-Endpoint 基礎
CWE-302: Authentication Bypass by Assumed-Immutable Data 基礎
CWE-303: Incorrect Implementation of Authentication Algorithm 基礎
CWE-304: Missing Critical Step in Authentication 基礎
CWE-305: Authentication Bypass by Primary Weakness 基礎
CWE-306: Missing Authentication for Critical Functionality 基礎
CWE-307: Improper Restriction of Excessive Authentication Attempts 基礎
CWE-308: Use of Single-factor Authentication 基礎
CWE-309: Use of Password System for Primary Authentication 基礎
CWE-346: Origin Validation Error 基礎
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action 基礎
CWE-384: Session Fixation 基礎
CWE-521: Weak Password Requirements 基礎
CWE-613: DEPRECATED: Insufficient Session Expiration 基礎
CWE-620: Unverified Password Change 基礎
CWE-640: Weak Password Recovery Mechanism for Forgotten Password 基礎
CWE-798: Use of Hard-coded Credentials 基礎
CWE-940: Improper Verification of Source of a Communication Channel 基礎
CWE-941: Incorrectly Specified Destination in a Communication Channel 基礎

CWE 檢視資訊

漏洞對應備注

理由說明 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
備註 : Use this View or other Views to search and navigate for the appropriate weakness.

備注

As of CWE 4.19, the relationships in this view were pulled directly from the CWE mappings cited in the 2025 OWASP Top Ten RC1. These mappings include categories and high-level weaknesses. One mapping to a deprecated entry was removed. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

受眾

相關方 描述
Software Developers This view outlines the most important issues as identified by the OWASP Top Ten (2025 RC1), providing a good starting point for web application developers who want to code more securely.
Product Customers This view outlines the most important issues as identified by the OWASP Top Ten (2025 RC1), providing product customers with a way of asking their software development teams to follow minimum expectations for secure code.
Educators Since the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students.

提交

名稱 機構 日期 發布日期 Version
CWE Content Team MITRE 2024-12-01 +00:00 2025-12-11 +00:00 4.19

參考資料

REF-1500

OWASP Top 10:2025 RC1
https://owasp.org/Top10/2025/0x00_2025-Introduction/

cvefind.com 上呈現的資訊來自多個精心挑選的參考來源。CVE 資料由 MITRE Corporation 和 國家漏洞資料庫（NVD）提供。已知被利用漏洞（KEV）目錄來自 網路安全暨基礎設施安全局（CISA），而 EPSS 評分來自 FIRST.org。此外，軟體弱點（CWE）和常見攻擊模式（CAPEC）的資料由 MITRE Corporation 維護，硬軟體配置（CPE）資訊由 NVD 提供。