CWE VIEW: Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses
CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.
The following graph shows the tree-like relationships between weaknesses that exist at different levels of abstraction. At the highest level, categories and pillars exist to group weaknesses. Categories (which are not technically weaknesses) are special CWE entries used to group weaknesses that share a common characteristic. Pillars are weaknesses that are described in the most abstract fashion. Below these top-level entries are weaknesses are varying levels of abstraction. Classes are still very abstract, typically independent of any specific language or technology. Base level weaknesses are used to present a more specific type of weakness. A variant is a weakness that is described at a very low level of detail, typically limited to a specific language or technology. A chain is a set of weaknesses that must be reachable consecutively in order to produce an exploitable vulnerability. While a composite is a set of weaknesses that must all be present simultaneously in order to produce an exploitable vulnerability. Show Details:
1387 - Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses
1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 787 (Out-of-bounds Write) The product writes data past the end, or before the beginning, of the intended buffer.Memory Corruption 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.XSSHTML InjectionCSS 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.SQL injectionSQLi 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 20 (Improper Input Validation) The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly. 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 125 (Out-of-bounds Read) The product reads data past the end, or before the beginning, of the intended buffer.OOB read 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')) The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Shell injectionShell metacharactersOS Command Injection 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 416 (Use After Free) The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.Dangling pointerUAFUse-After-Free 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Directory traversalPath traversal 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 352 (Cross-Site Request Forgery (CSRF)) The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Session RidingCross Site Reference ForgeryXSRF 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 434 (Unrestricted Upload of File with Dangerous Type) The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.Unrestricted File Upload 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 476 (NULL Pointer Dereference) The product dereferences a pointer that it expects to be valid but is NULL.NPDnull derefNPEnil pointer dereference 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 502 (Deserialization of Untrusted Data) The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.Marshaling, UnmarshalingPickling, UnpicklingPHP Object Injection 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 190 (Integer Overflow or Wraparound) The product performs a calculation that can
produce an integer overflow or wraparound when the logic
assumes that the resulting value will always be larger than
the original value. This occurs when an integer value is
incremented to a value that is too large to store in the
associated representation. When this occurs, the value may
become a very small or negative number.OverflowWraparoundwrap, wrap-around, wrap around 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 287 (Improper Authentication) When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.authentificationAuthNAuthC 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 798 (Use of Hard-coded Credentials) The product contains hard-coded credentials, such as a password or cryptographic key. 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.AuthZ 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')) The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.Command injection 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 306 (Missing Authentication for Critical Function) The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Buffer Overflowbuffer overrunmemory safety 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 276 (Incorrect Default Permissions) During installation, installed file permissions are set to allow anyone to modify those files. 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 918 (Server-Side Request Forgery (SSRF)) The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.XSPA 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 400 (Uncontrolled Resource Consumption) The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.Resource Exhaustion 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 611 (Improper Restriction of XML External Entity Reference) The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.XXE 1387 (Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses) > 94 (Improper Control of Generation of Code ('Code Injection')) The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
More information is available — Please edit the custom filter or select a different filter. |
Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2024, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. |