繁體中文

CWE-884 檢視詳細資料

CWE-884

CWE Cross-section
2011-12-15 +00:00
Incomplete
Explicit
2023-06-29 +00:00
CWE Mitre.org
指定 CWE 通知
掌握特定 CWE 的任何變更。
管理通知

名稱: CWE Cross-section

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

CWE 成員

CWE-14: Compiler Removal of Code to Clear Buffers 基礎

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 基礎

CWE-23: Relative Path Traversal 基礎

CWE-36: Absolute Path Traversal 基礎

CWE-41: Improper Resolution of Path Equivalence 基礎

CWE-59: Improper Link Resolution Before File Access 基礎

CWE-78: Improper Neutralization of Special Elements used in an OS Command 基礎

CWE-79: Improper Neutralization of Input During Web Page Generation 基礎

CWE-88: Improper Neutralization of Argument Delimiters in a Command 基礎

CWE-89: Improper Neutralization of Special Elements used in an SQL Command 基礎

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 基礎

CWE-94: Improper Control of Generation of Code 基礎

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code 基礎

CWE-96: Improper Neutralization of Directives in Statically Saved Code 基礎

CWE-99: Improper Control of Resource Identifiers 基礎

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 基礎

CWE-117: Improper Output Neutralization for Logs 基礎

CWE-120: Buffer Copy without Checking Size of Input 基礎

CWE-129: Improper Validation of Array Index 基礎

CWE-131: Incorrect Calculation of Buffer Size 基礎

CWE-134: Use of Externally-Controlled Format String 基礎

CWE-135: Incorrect Calculation of Multi-Byte String Length 基礎

CWE-170: Improper Null Termination 基礎

CWE-173: Improper Handling of Alternate Encoding 基礎

CWE-174: Double Decoding of the Same Data 基礎

CWE-175: Improper Handling of Mixed Encoding 基礎

CWE-179: Incorrect Behavior Order: Early Validation 基礎

CWE-185: Incorrect Regular Expression 基礎

CWE-190: Integer Overflow or Wraparound 基礎

CWE-191: Integer Underflow (Wrap or Wraparound) 基礎

CWE-193: Off-by-one Error 基礎

CWE-203: Observable Discrepancy 基礎

CWE-209: Generation of Error Message Containing Sensitive Information 基礎

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer 基礎

CWE-222: Truncation of Security-relevant Information 基礎

CWE-223: Omission of Security-relevant Information 基礎

CWE-228: Improper Handling of Syntactically Invalid Structure 基礎

CWE-244: Improper Clearing of Heap Memory Before Release 基礎

CWE-248: Uncaught Exception 基礎

CWE-250: Execution with Unnecessary Privileges 基礎

CWE-252: Unchecked Return Value 基礎

CWE-253: Incorrect Check of Function Return Value 基礎

CWE-262: Not Using Password Aging 基礎

CWE-263: Password Aging with Long Expiration 基礎

CWE-266: Incorrect Privilege Assignment 基礎

CWE-267: Privilege Defined With Unsafe Actions 基礎

CWE-268: Privilege Chaining 基礎

CWE-270: Privilege Context Switching Error 基礎

CWE-271: Privilege Dropping / Lowering Errors 基礎

CWE-273: Improper Check for Dropped Privileges 基礎

CWE-283: Unverified Ownership 基礎

CWE-290: Authentication Bypass by Spoofing 基礎

CWE-294: Authentication Bypass by Capture-replay 基礎

CWE-296: Improper Following of a Certificate's Chain of Trust 基礎

CWE-299: Improper Check for Certificate Revocation 基礎

CWE-300: Channel Accessible by Non-Endpoint 基礎

CWE-301: Reflection Attack in an Authentication Protocol 基礎

CWE-304: Missing Critical Step in Authentication 基礎

CWE-306: Missing Authentication for Critical Functionality 基礎

CWE-307: Improper Restriction of Excessive Authentication Attempts 基礎

CWE-308: Use of Single-factor Authentication 基礎

CWE-312: Cleartext Storage of Sensitive Information 基礎

CWE-319: Cleartext Transmission of Sensitive Information 基礎

CWE-322: Key Exchange without Entity Authentication 基礎

CWE-323: Reusing a Nonce, Key Pair in Encryption 基礎

CWE-325: Missing Cryptographic Step 基礎

CWE-327: Use of a Broken or Risky Cryptographic Algorithm 基礎

CWE-331: Insufficient Entropy 基礎

CWE-334: Small Space of Random Values 基礎

CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 基礎

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 基礎

CWE-341: Predictable from Observable State 基礎

CWE-347: Improper Verification of Cryptographic Signature 基礎

CWE-348: Use of Less Trusted Source 基礎

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data 基礎

CWE-352: Cross-Site Request Forgery 基礎

CWE-353: Missing Support for Integrity Check 基礎

CWE-354: Improper Validation of Integrity Check Value 基礎

CWE-364: Signal Handler Race Condition 基礎

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition 基礎

CWE-369: Divide By Zero 基礎

CWE-390: Detection of Error Condition Without Action 基礎

CWE-392: Missing Report of Error Condition 基礎

CWE-393: Return of Wrong Status Code 基礎

CWE-400: Uncontrolled Resource Consumption 基礎

CWE-406: Insufficient Control of Network Message Volume (Network Amplification) 基礎

CWE-407: Inefficient Algorithmic Complexity 基礎

CWE-408: Incorrect Behavior Order: Early Amplification 基礎

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) 基礎

CWE-434: Unrestricted Upload of File with Dangerous Type 基礎

CWE-444: Inconsistent Interpretation of HTTP Requests 基礎

CWE-451: User Interface (UI) Misrepresentation of Critical Information 基礎

CWE-453: Insecure Default Variable Initialization 基礎

CWE-454: External Initialization of Trusted Variables or Data Stores 基礎

CWE-455: Non-exit on Failed Initialization 基礎

CWE-456: Missing Initialization of a Variable 基礎

CWE-467: Use of sizeof() on a Pointer Type 基礎

CWE-468: Incorrect Pointer Scaling 基礎

CWE-469: Use of Pointer Subtraction to Determine Size 基礎

CWE-470: Use of Externally-Controlled Input to Select Classes or Code 基礎

CWE-476: NULL Pointer Dereference 基礎

CWE-478: Missing Default Case in Multiple Condition Expression 基礎

CWE-480: Use of Incorrect Operator 基礎

CWE-483: Incorrect Block Delimitation 基礎

CWE-484: Omitted Break Statement in Switch 基礎

CWE-486: Comparison of Classes by Name 基礎

CWE-494: Download of Code Without Integrity Check 基礎

CWE-495: Private Data Structure Returned From A Public Method 基礎

CWE-496: Public Data Assigned to Private Array-Typed Field 基礎

CWE-498: Cloneable Class Containing Sensitive Information 基礎

CWE-499: Serializable Class Containing Sensitive Data 基礎

CWE-502: Deserialization of Untrusted Data 基礎

CWE-521: Weak Password Requirements 基礎

CWE-522: Insufficiently Protected Credentials 基礎

CWE-546: Suspicious Comment 基礎

CWE-547: Use of Hard-coded, Security-relevant Constants 基礎

CWE-561: Dead Code 基礎

CWE-563: Assignment to Variable without Use 基礎

CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context 基礎

CWE-587: Assignment of a Fixed Address to a Pointer 基礎

CWE-595: Comparison of Object References Instead of Object Contents 基礎

CWE-601: URL Redirection to Untrusted Site 基礎

CWE-602: Client-Side Enforcement of Server-Side Security 基礎

CWE-605: Multiple Binds to the Same Port 基礎

CWE-617: Reachable Assertion 基礎

CWE-621: Variable Extraction Error 基礎

CWE-627: Dynamic Variable Evaluation 基礎

CWE-628: Function Call with Incorrectly Specified Arguments 基礎

CWE-642: External Control of Critical State Data 基礎

CWE-648: Incorrect Use of Privileged APIs 基礎

CWE-667: Improper Locking 基礎

CWE-672: Operation on a Resource after Expiration or Release 基礎

CWE-674: Uncontrolled Recursion 基礎

CWE-676: Use of Potentially Dangerous Function 基礎

CWE-681: Incorrect Conversion between Numeric Types 基礎

CWE-698: Execution After Redirect (EAR) 基礎

CWE-708: Incorrect Ownership Assignment 基礎

CWE-732: Incorrect Permission Assignment for Critical Resource 基礎

CWE-756: Missing Custom Error Page 基礎

CWE-763: Release of Invalid Pointer or Reference 基礎

CWE-770: Allocation of Resources Without Limits or Throttling 基礎

CWE-772: Missing Release of Resource after Effective Lifetime 基礎

CWE-783: Operator Precedence Logic Error 基礎

CWE-786: Access of Memory Location Before Start of Buffer 基礎

CWE-788: Access of Memory Location After End of Buffer 基礎

CWE-798: Use of Hard-coded Credentials 基礎

CWE-805: Buffer Access with Incorrect Length Value 基礎

CWE-807: Reliance on Untrusted Inputs in a Security Decision 基礎

CWE-822: Untrusted Pointer Dereference 基礎

CWE-825: Expired Pointer Dereference 基礎

CWE-829: Inclusion of Functionality from Untrusted Control Sphere 基礎

CWE-835: Loop with Unreachable Exit Condition 基礎

CWE-838: Inappropriate Encoding for Output Context 基礎

CWE-839: Numeric Range Comparison Without Minimum Check 基礎

CWE-841: Improper Enforcement of Behavioral Workflow 基礎

CWE-862: Missing Authorization 基礎

CWE-863: Incorrect Authorization 基礎

CWE 檢視資訊

漏洞對應備注

理由說明 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
備註 : Use this View or other Views to search and navigate for the appropriate weakness.

提交

名稱 機構 日期 發布日期 Version
CWE Content Team MITRE 2011-12-15 +00:00 2012-05-14 +00:00 2.2

修改記錄

名稱 機構 日期 備註
CWE Content Team MITRE 2017-05-03 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
cvefind.com 上呈現的資訊來自多個精心挑選的參考來源。CVE 資料由 MITRE Corporation 和 國家漏洞資料庫（NVD）提供。已知被利用漏洞（KEV）目錄來自 網路安全暨基礎設施安全局（CISA），而 EPSS 評分來自 FIRST.org。此外，軟體弱點（CWE）和常見攻擊模式（CAPEC）的資料由 MITRE Corporation 維護，硬軟體配置（CPE）資訊由 NVD 提供。