CWE
Home > CWE List > VIEW LIST: CWE-750: Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors (1.6)  

CWE-750: Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors

 
Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors
Definition in a New Window Definition in a New Window
View ID: 750 (View: Graph)Status: Incomplete
+ View Data

View Objective

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors.

+ View Metrics
CWEs in this viewTotal CWEs
Total28out of791
Views0out of22
Categories3out of106
Weaknesses23out of651
Compound_Elements2out of12
+ View Audience
StakeholderDescription
Developers

By following the Top 25, developers will be able to significantly reduce the number of weaknesses that occur in their software.

Software Customers

If a software developer claims to be following the Top 25, then customers can search for the weaknesses in this view in order to formulate independent evidence of that claim.

Educators

Educators can use this view in multiple ways. For example, if there is a focus on teaching weaknesses, the educator could focus on the Top 25.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
HasMemberCategoryCategory751Insecure Interaction Between Components
Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors (primary)750
HasMemberCategoryCategory752Risky Resource Management
Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors (primary)750
HasMemberCategoryCategory753Porous Defenses
Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors (primary)750
+ References
"2009 CWE/SANS Top 25 Most Dangerous Programming Errors". 2009-01-12. <http://cwe.mitre.org/top25>.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2009-01-12Internal CWE Team
more
Weakness BaseWeakness Base Cleartext Transmission of Sensitive Information - (319)
Weakness BaseWeakness Base Client-Side Enforcement of Server-Side Security - (602)
Compound Element: CompositeCompound Element: Composite Cross-Site Request Forgery (CSRF) - (352)
Weakness BaseWeakness Base Download of Code Without Integrity Check - (494)
Weakness BaseWeakness Base Error Message Information Leak - (209)
Weakness ClassWeakness Class Execution with Unnecessary Privileges - (250)
Weakness ClassWeakness Class External Control of Critical State Data - (642)
Weakness ClassWeakness Class External Control of File Name or Path - (73)
Weakness ClassWeakness Class Failure to Constrain Operations within the Bounds of a Memory Buffer - (119)
Weakness ClassWeakness Class Failure to Control Generation of Code ('Code Injection') - (94)
Weakness BaseWeakness Base Failure to Preserve Web Page Structure ('Cross-site Scripting') - (79)
Weakness BaseWeakness Base Hard-Coded Password - (259)
Weakness ClassWeakness Class Improper Access Control (Authorization) - (285)
Weakness ClassWeakness Class Improper Encoding or Escaping of Output - (116)
Weakness BaseWeakness Base Improper Initialization - (665)
Weakness ClassWeakness Class Improper Input Validation - (20)
Weakness BaseWeakness Base Improper Resource Shutdown or Release - (404)
Weakness BaseWeakness Base Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') - (78)
Weakness BaseWeakness Base Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') - (89)
Weakness ClassWeakness Class Incorrect Calculation - (682)
Weakness ClassWeakness Class Incorrect Permission Assignment for Critical Resource - (732)
CategoryCategory Insecure Interaction Between Components - (751)
CategoryCategory Porous Defenses - (753)
Weakness ClassWeakness Class Race Condition - (362)
CategoryCategory Risky Resource Management - (752)
Compound Element: CompositeCompound Element: Composite Untrusted Search Path - (426)
Weakness BaseWeakness Base Use of a Broken or Risky Cryptographic Algorithm - (327)
Weakness ClassWeakness Class Use of Insufficiently Random Values - (330)
Page Last Updated: October 29, 2009
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us