CWE-888 軟體弱點詳細資料 | CVE Find

廠商與產品

CPE（通用平台枚舉）是一種用於命名硬體、軟體和作業系統的標準化方案。CPE 提供結構化命名方式，可根據廠商、產品名稱、版本、更新、版次和語言等特定屬性，唯一識別和分類資訊技術系統、平台和套件。

名稱: Software Fault Pattern (SFP) Clusters

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

CWE 成員

CWE-885: SFP Primary Cluster: Risky Values 類別

CWE-885: This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

CWE-998: SFP Secondary Cluster: Glitch in Computation 類別

CWE-886: SFP Primary Cluster: Unused entities 類別

CWE-886: This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

CWE-482: Comparing instead of Assigning 基礎

CWE-561: Dead Code 基礎

CWE-563: Assignment to Variable without Use 基礎

CWE-887: SFP Primary Cluster: API 類別

CWE-887: This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

CWE-1001: SFP Secondary Cluster: Use of an Improper API 類別

CWE-889: SFP Primary Cluster: Exception Management 類別

CWE-889: This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

CWE-960: SFP Secondary Cluster: Ambiguous Exception Type 類別

CWE-961: SFP Secondary Cluster: Incorrect Exception Behavior 類別

CWE-962: SFP Secondary Cluster: Unchecked Status Condition 類別

CWE-890: SFP Primary Cluster: Memory Access 類別

CWE-890: This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

CWE-970: SFP Secondary Cluster: Faulty Buffer Access 類別

CWE-971: SFP Secondary Cluster: Faulty Pointer Use 類別

CWE-972: SFP Secondary Cluster: Faulty String Expansion 類別

CWE-973: SFP Secondary Cluster: Improper NULL Termination 類別

CWE-974: SFP Secondary Cluster: Incorrect Buffer Length Computation 類別

CWE-891: SFP Primary Cluster: Memory Management 類別

CWE-891: This category identifies Software Fault Patterns (SFPs) within the Memory Management cluster (SFP38).

CWE-969: SFP Secondary Cluster: Faulty Memory Release 類別

CWE-892: SFP Primary Cluster: Resource Management 類別

CWE-892: This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

CWE-982: SFP Secondary Cluster: Failure to Release Resource 類別

CWE-983: SFP Secondary Cluster: Faulty Resource Use 類別

CWE-984: SFP Secondary Cluster: Life Cycle 類別

CWE-985: SFP Secondary Cluster: Unrestricted Consumption 類別

CWE-893: SFP Primary Cluster: Path Resolution 類別

CWE-893: This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

CWE-979: SFP Secondary Cluster: Failed Chroot Jail 類別

CWE-980: SFP Secondary Cluster: Link in Resource Name Resolution 類別

CWE-981: SFP Secondary Cluster: Path Traversal 類別

CWE-894: SFP Primary Cluster: Synchronization 類別

CWE-894: This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).

CWE-986: SFP Secondary Cluster: Missing Lock 類別

CWE-987: SFP Secondary Cluster: Multiple Locks/Unlocks 類別

CWE-988: SFP Secondary Cluster: Race Condition Window 類別

CWE-989: SFP Secondary Cluster: Unrestricted Lock 類別

CWE-895: SFP Primary Cluster: Information Leak 類別

CWE-895: This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

CWE-963: SFP Secondary Cluster: Exposed Data 類別

CWE-964: SFP Secondary Cluster: Exposure Temporary File 類別

CWE-965: SFP Secondary Cluster: Insecure Session Management 類別

CWE-966: SFP Secondary Cluster: Other Exposures 類別

CWE-967: SFP Secondary Cluster: State Disclosure 類別

CWE-896: SFP Primary Cluster: Tainted Input 類別

CWE-896: This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

CWE-990: SFP Secondary Cluster: Tainted Input to Command 類別

CWE-991: SFP Secondary Cluster: Tainted Input to Environment 類別

CWE-992: SFP Secondary Cluster: Faulty Input Transformation 類別

CWE-993: SFP Secondary Cluster: Incorrect Input Handling 類別

CWE-994: SFP Secondary Cluster: Tainted Input to Variable 類別

CWE-897: SFP Primary Cluster: Entry Points 類別

CWE-897: This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).

CWE-1002: SFP Secondary Cluster: Unexpected Entry Points 類別

CWE-898: SFP Primary Cluster: Authentication 類別

CWE-898: This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

CWE-947: SFP Secondary Cluster: Authentication Bypass 類別

CWE-948: SFP Secondary Cluster: Digital Certificate 類別

CWE-949: SFP Secondary Cluster: Faulty Endpoint Authentication 類別

CWE-950: SFP Secondary Cluster: Hardcoded Sensitive Data 類別

CWE-951: SFP Secondary Cluster: Insecure Authentication Policy 類別

CWE-952: SFP Secondary Cluster: Missing Authentication 類別

CWE-953: SFP Secondary Cluster: Missing Endpoint Authentication 類別

CWE-954: SFP Secondary Cluster: Multiple Binds to the Same Port 類別

CWE-955: SFP Secondary Cluster: Unrestricted Authentication 類別

CWE-899: SFP Primary Cluster: Access Control 類別

CWE-899: This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

CWE-944: SFP Secondary Cluster: Access Management 類別

CWE-945: SFP Secondary Cluster: Insecure Resource Access 類別

CWE-946: SFP Secondary Cluster: Insecure Resource Permissions 類別

CWE-901: SFP Primary Cluster: Privilege 類別

CWE-901: This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).

CWE-250: Execution with Unnecessary Privileges 基礎

CWE-266: Incorrect Privilege Assignment 基礎

CWE-267: Privilege Defined With Unsafe Actions 基礎

CWE-268: Privilege Chaining 基礎

CWE-269: Improper Privilege Management 基礎

CWE-270: Privilege Context Switching Error 基礎

CWE-271: Privilege Dropping / Lowering Errors 基礎

CWE-272: Least Privilege Violation 基礎

CWE-274: Improper Handling of Insufficient Privileges 基礎

CWE-520: .NET Misconfiguration: Use of Impersonation 基礎

CWE-653: Improper Isolation or Compartmentalization 基礎

CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods 基礎

CWE-902: SFP Primary Cluster: Channel 類別

CWE-902: This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

CWE-956: SFP Secondary Cluster: Channel Attack 類別

CWE-957: SFP Secondary Cluster: Protocol Error 類別

CWE-903: SFP Primary Cluster: Cryptography 類別

CWE-903: This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

CWE-958: SFP Secondary Cluster: Broken Cryptography 類別

CWE-959: SFP Secondary Cluster: Weak Cryptography 類別

CWE-904: SFP Primary Cluster: Malware 類別

CWE-904: This category identifies Software Fault Patterns (SFPs) within the Malware cluster.

CWE-506: Embedded Malicious Code 基礎

CWE-507: Trojan Horse 基礎

CWE-508: Non-Replicating Malicious Code 基礎

CWE-509: Replicating Malicious Code (Virus or Worm) 基礎

CWE-510: Trapdoor 基礎

CWE-511: Logic/Time Bomb 基礎

CWE-512: Spyware 基礎

CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream 基礎

CWE-968: SFP Secondary Cluster: Covert Channel 類別

CWE-905: SFP Primary Cluster: Predictability 類別

CWE-905: This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

CWE-330: Use of Insufficiently Random Values 基礎

CWE-331: Insufficient Entropy 基礎

CWE-332: Insufficient Entropy in PRNG 基礎

CWE-333: Improper Handling of Insufficient Entropy in TRNG 基礎

CWE-334: Small Space of Random Values 基礎

CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 基礎

CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) 基礎

CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) 基礎

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 基礎

CWE-339: Small Seed Space in PRNG 基礎

CWE-340: Generation of Predictable Numbers or Identifiers 基礎

CWE-341: Predictable from Observable State 基礎

CWE-342: Predictable Exact Value from Previous Values 基礎

CWE-343: Predictable Value Range from Previous Values 基礎

CWE-344: Use of Invariant Value in Dynamically Changing Context 基礎

CWE-906: SFP Primary Cluster: UI 類別

CWE-906: This category identifies Software Fault Patterns (SFPs) within the UI cluster.

CWE-995: SFP Secondary Cluster: Feature 類別

CWE-996: SFP Secondary Cluster: Security 類別

CWE-997: SFP Secondary Cluster: Information Loss 類別

CWE-907: SFP Primary Cluster: Other 類別

CWE-907: This category identifies Software Fault Patterns (SFPs) within the Other cluster.

CWE-975: SFP Secondary Cluster: Architecture 類別

CWE-976: SFP Secondary Cluster: Compiler 類別

CWE-977: SFP Secondary Cluster: Design 類別

CWE-978: SFP Secondary Cluster: Implementation 類別

CWE-1237: SFP Primary Cluster: Faulty Resource Release 類別

CWE-1237: This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Release cluster (SFP37).

CWE-415: Double Free 基礎

CWE-762: Mismatched Memory Management Routines 基礎

CWE-763: Release of Invalid Pointer or Reference 基礎

CWE-1238: SFP Primary Cluster: Failure to Release Memory 類別

CWE-1238: This category identifies Software Fault Patterns (SFPs) within the Failure to Release Memory cluster (SFP38).

CWE-401: Missing Release of Memory after Effective Lifetime 基礎

CWE 檢視資訊

漏洞對應備注

理由說明 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
備註 : Use this View or other Views to search and navigate for the appropriate weakness.

受眾

相關方	描述
Applied Researchers
Academic Researchers
Product Vendors

提交

名稱	機構	日期	發布日期	Version
CWE Content Team	MITRE	2012-03-22 +00:00	2012-05-14 +00:00	2.2

修改記錄

名稱	機構	日期	備註
CWE Content Team	MITRE	2020-02-24 +00:00	updated References, View_Audience
CWE Content Team	MITRE	2020-08-20 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated References

參考資料

REF-19

System Assurance
Nikolai Mansourov, Djenana Campara.
https://www.elsevier.com/books/system-assurance/mansourov/978-0-12-381414-2

REF-20

Task Order 0006: Vulnerability Path Analysis and Demonstration (VPAD). Volume 2 - White Box Definitions of Software Fault Patterns
Ben Calloni, Nikolai Mansourov, Djenana Campara.
https://apps.dtic.mil/sti/tr/pdf/ADB381215.pdf