CWE
Home > CWE List > VIEW GRAPH: CWE-1000: Research Concepts (1.6)  

CWE-1000: Research Concepts

 
Research Concepts
Definition in a New Window Definition in a New Window
View ID: 1000 (View: Graph)Status: Draft
+ View Data

View Objective

This view is intended to facilitate research into weaknesses, including their inter-dependencies and their role in vulnerabilities. It classifies weaknesses in a way that largely ignores how they can be detected, where they appear in code, and when they are introduced in the software development life-cycle. Instead, it is mainly organized according to abstractions of software behaviors. It uses a deep hierarchical organization, with more levels of abstraction than other classification schemes. The top-level entries are called Pillars.

Where possible, this view uses abstractions that do not consider particular languages, frameworks, technologies, life-cycle development phases, frequency of occurrence, or types of resources. It explicitly identifies relationships that form chains and composites, which have not been a formal part of past classification efforts. Chains and composites might help explain why mutual exclusivity is difficult to achieve within security error taxonomies.

This view is roughly aligned with MITRE's research into vulnerability theory, especially with respect to behaviors and resources. Ideally, this view will only cover weakness-to-weakness relationships, with minimal overlap and very few categories. This view could be useful for academic research, CWE maintenance, and mapping. It can be leveraged to systematically identify theoretical gaps within CWE and, by extension, the general security community.

+ View Metrics
CWEs in this viewTotal CWEs
Total663out of791
Views0out of22
Categories10out of106
Weaknesses641out of651
Compound_Elements12out of12
+ View Audience
StakeholderDescription
Academic Researchers

This view provides an organizational structure for weaknesses that is different than the approaches undertaken by taxonomies such as Seven Pernicious Kingdoms.

Applied Researchers

Applied researchers could use the higher-level classes and bases to identify potential areas for future research.

Developers

Developers who have fully integrated security into their SDLC might find this view useful in identifying general patterns of issues within code, instead of relying heavily on "badness lists" that only cover the most severe issues.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
HasMemberWeakness ClassWeakness Class118Improper Access of Indexable Resource ('Range Error')
Research Concepts (primary)1000
HasMemberWeakness ClassWeakness Class330Use of Insufficiently Random Values
Research Concepts (primary)1000
HasMemberWeakness ClassWeakness Class435Interaction Error
Research Concepts (primary)1000
HasMemberWeakness ClassWeakness Class664Improper Control of a Resource Through its Lifetime
Research Concepts (primary)1000
HasMemberWeakness ClassWeakness Class682Incorrect Calculation
Research Concepts (primary)1000
HasMemberWeakness ClassWeakness Class691Insufficient Control Flow Management
Research Concepts (primary)1000
HasMemberWeakness ClassWeakness Class693Protection Mechanism Failure
Research Concepts (primary)1000
HasMemberWeakness ClassWeakness Class697Insufficient Comparison
Research Concepts (primary)1000
HasMemberWeakness ClassWeakness Class703Failure to Handle Exceptional Conditions
Research Concepts (primary)1000
HasMemberWeakness ClassWeakness Class706Use of Incorrectly-Resolved Name or Reference
Research Concepts (primary)1000
HasMemberWeakness ClassWeakness Class707Improper Enforcement of Message or Data Structure
Research Concepts (primary)1000
HasMemberWeakness ClassWeakness Class710Coding Standards Violation
Research Concepts (primary)1000
+ Content History
Modifications
Modification DateModifierOrganizationSource
2008-09-08CWE Content TeamMITREInternal
updated Description, Name, Relationships, View Audience, View Structure
1000 - Research Concepts
+Weakness ClassWeakness ClassCoding Standards Violation - (710)Coding Standards Violation - (710)
+Weakness ClassWeakness ClassEmbedded Malicious Code - (506)Embedded Malicious Code - (506)
*Weakness BaseWeakness BaseLogic/Time Bomb - (511)Logic/Time Bomb - (511)
*Weakness BaseWeakness BaseSpyware - (512)Spyware - (512)
*Weakness BaseWeakness BaseTrapdoor - (510)Trapdoor - (510)
+Weakness ClassWeakness ClassFailure to Fulfill API Contract ('API Abuse') - (227)Failure to Fulfill API Contract ('API Abuse') - (227)
+Weakness ClassWeakness ClassFailure to Follow Specification - (573)Failure to Follow Specification - (573)
+Weakness BaseWeakness BaseFunction Call with Incorrectly Specified Arguments - (628)Function Call with Incorrectly Specified Arguments - (628)
+Weakness BaseWeakness BaseUse of Low-Level Functionality - (695)Use of Low-Level Functionality - (695)
+Weakness ClassWeakness ClassIndicator of Poor Code Quality - (398)Indicator of Poor Code Quality - (398)
+Weakness VariantWeakness VariantDead Code - (561)Dead Code - (561)
*Weakness VariantWeakness VariantEmpty Synchronized Block - (585)Empty Synchronized Block - (585)
*Weakness VariantWeakness VariantSuspicious Comment - (546)Suspicious Comment - (546)
*Weakness VariantWeakness VariantUnused Variable - (563)Unused Variable - (563)
+Weakness ClassWeakness ClassReliance on Undefined, Unspecified, or Implementation-Defined Behavior - (758)Reliance on Undefined, Unspecified, or Implementation-Defined Behavior - (758)
+Weakness ClassWeakness ClassViolation of Secure Design Principles - (657)Violation of Secure Design Principles - (657)
+Weakness ClassWeakness ClassFailure to Handle Exceptional Conditions - (703)Failure to Handle Exceptional Conditions - (703)
+Weakness ClassWeakness ClassImproper Check for Exceptional Conditions - (754)Improper Check for Exceptional Conditions - (754)
+Weakness ClassWeakness ClassImproper Handling of Exceptional Conditions - (755)Improper Handling of Exceptional Conditions - (755)
+Weakness BaseWeakness BaseError Message Information Leak - (209)Error Message Information Leak - (209)
+Weakness ClassWeakness ClassImproper Handling of Syntactically Invalid Structure - (228)Improper Handling of Syntactically Invalid Structure - (228)
*Weakness BaseWeakness BaseUncaught Exception - (248)Uncaught Exception - (248)
*Weakness BaseWeakness BaseUnverified Ownership - (283)Unverified Ownership - (283)
+Weakness ClassWeakness ClassImproper Access of Indexable Resource ('Range Error') - (118)Improper Access of Indexable Resource ('Range Error') - (118)
+Weakness ClassWeakness ClassFailure to Constrain Operations within the Bounds of a Memory Buffer - (119)Failure to Constrain Operations within the Bounds of a Memory Buffer - (119)
+Weakness BaseWeakness BaseOut-of-bounds Read - (125)Out-of-bounds Read - (125)
*Weakness VariantWeakness VariantBuffer Over-read - (126)Buffer Over-read - (126)
*Weakness VariantWeakness VariantBuffer Under-read - (127)Buffer Under-read - (127)
+Weakness ClassWeakness ClassImproper Control of a Resource Through its Lifetime - (664)Improper Control of a Resource Through its Lifetime - (664)
+Weakness ClassWeakness ClassCovert Channel - (514)Covert Channel - (514)
*Weakness BaseWeakness BaseCovert Timing Channel - (385)Covert Timing Channel - (385)
+Weakness ClassWeakness ClassExposure of Resource to Wrong Sphere - (668)Exposure of Resource to Wrong Sphere - (668)
+Weakness ClassWeakness ClassExternal Control of Critical State Data - (642)External Control of Critical State Data - (642)
+Weakness BaseWeakness BaseFiles or Directories Accessible to External Parties - (552)Files or Directories Accessible to External Parties - (552)
+Weakness ClassWeakness ClassInformation Leak (Information Disclosure) - (200)Information Leak (Information Disclosure) - (200)
+Weakness BaseWeakness BaseError Message Information Leak - (209)Error Message Information Leak - (209)
+Weakness BaseWeakness BaseFile and Directory Information Leaks - (538)File and Directory Information Leaks - (538)
+Weakness BaseWeakness BaseInsufficiently Protected Credentials - (522)Insufficiently Protected Credentials - (522)
+Weakness BaseWeakness BaseImproper Privilege Management - (269)Improper Privilege Management - (269)
+Weakness ClassWeakness ClassPath Traversal - (22)Path Traversal - (22)
+Weakness BaseWeakness BaseRelative Path Traversal - (23)Relative Path Traversal - (23)
+Weakness ClassWeakness ClassExternally Controlled Reference to a Resource in Another Sphere - (610)Externally Controlled Reference to a Resource in Another Sphere - (610)
+Weakness BaseWeakness BaseImproper Initialization - (665)Improper Initialization - (665)
+Weakness BaseWeakness BaseImproper Resource Shutdown or Release - (404)Improper Resource Shutdown or Release - (404)
*Weakness VariantWeakness VariantNot Using Password Aging - (262)Not Using Password Aging - (262)
+Weakness ClassWeakness ClassIncorrect Resource Transfer Between Spheres - (669)Incorrect Resource Transfer Between Spheres - (669)
+Weakness ClassWeakness ClassInformation Loss or Omission - (221)Information Loss or Omission - (221)
+Weakness ClassWeakness ClassInsufficient Encapsulation - (485)Insufficient Encapsulation - (485)
*Weakness BaseWeakness BaseLeftover Debug Code - (489)Leftover Debug Code - (489)
+Weakness BaseWeakness BaseOperation on Resource in Wrong Phase of Lifetime - (666)Operation on Resource in Wrong Phase of Lifetime - (666)
+Weakness BaseWeakness BaseUncontrolled Resource Consumption ('Resource Exhaustion') - (400)Uncontrolled Resource Consumption ('Resource Exhaustion') - (400)
+Weakness ClassWeakness ClassImproper Enforcement of Message or Data Structure - (707)Improper Enforcement of Message or Data Structure - (707)
+Weakness ClassWeakness ClassFailure to Sanitize Data into a Different Plane ('Injection') - (74)Failure to Sanitize Data into a Different Plane ('Injection') - (74)
+Weakness ClassWeakness ClassFailure to Control Generation of Code ('Code Injection') - (94)Failure to Control Generation of Code ('Code Injection') - (94)
+Weakness BaseWeakness BaseFailure to Preserve Web Page Structure ('Cross-site Scripting') - (79)Failure to Preserve Web Page Structure ('Cross-site Scripting') - (79)
+Weakness ClassWeakness ClassImproper Handling of Syntactically Invalid Structure - (228)Improper Handling of Syntactically Invalid Structure - (228)
+Weakness ClassWeakness ClassImproper Sanitization of Special Elements - (138)Improper Sanitization of Special Elements - (138)
+Weakness ClassWeakness ClassFailure to Sanitize Special Element - (159)Failure to Sanitize Special Element - (159)
+Weakness VariantWeakness VariantImproper Sanitization of Trailing Special Elements - (162)Improper Sanitization of Trailing Special Elements - (162)
+Weakness ClassWeakness ClassIncorrect Calculation - (682)Incorrect Calculation - (682)
+Weakness ClassWeakness ClassInsufficient Comparison - (697)Insufficient Comparison - (697)