CWE
CWE/SANS Top 25 Most Dangerous Software Errors Common Weakness Scoring System
Common Weakness Risk Analysis Framework
Home > CWE List > VIEW LIST: CWE-900: Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors (2.1)  

CWE-900: Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors

 
Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors
Definition in a New Window Definition in a New Window
View ID: 900 (View: Graph)Status: Incomplete
+ View Data

View Objective

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

+ View Metrics
CWEs in this viewTotal CWEs
Total45out of909
Views0out of29
Categories4out of178
Weaknesses40out of693
Compound_Elements1out of9
+ View Audience
StakeholderDescription
Developers

By following the Top 25, developers will be able to significantly reduce the number of weaknesses that occur in their software.

Software_Customers

If a software developer claims to be following the Top 25, then customers can use the weaknesses in this view in order to formulate independent evidence of that claim.

Educators

Educators can use this view in multiple ways. For example, if there is a focus on teaching weaknesses, the educator could focus on the Top 25.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
HasMemberCategoryCategory8642011 Top 25 - Insecure Interaction Between Components
Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors (primary)900
HasMemberCategoryCategory8652011 Top 25 - Risky Resource Management
Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors (primary)900
HasMemberCategoryCategory8662011 Top 25 - Porous Defenses
Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors (primary)900
HasMemberCategoryCategory8672011 Top 25 - Weaknesses On the Cusp
Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors (primary)900
+ References
"2011 CWE/SANS Top 25 Most Dangerous Software Errors". 2011-06-27. <http://cwe.mitre.org/top25>.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2011-06-25Internal CWE Team
CategoryCategory 2011 Top 25 - Insecure Interaction Between Components - (864)
CategoryCategory 2011 Top 25 - Porous Defenses - (866)
CategoryCategory 2011 Top 25 - Risky Resource Management - (865)
CategoryCategory 2011 Top 25 - Weaknesses On the Cusp - (867)
Weakness BaseWeakness Base Allocation of Resources Without Limits or Throttling - (770)
Weakness BaseWeakness Base Buffer Access with Incorrect Length Value - (805)
Weakness BaseWeakness Base Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') - (120)
Weakness ClassWeakness Class Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') - (362)
Compound Element: CompositeCompound Element: Composite Cross-Site Request Forgery (CSRF) - (352)
Weakness BaseWeakness Base Download of Code Without Integrity Check - (494)
Weakness ClassWeakness Class Execution with Unnecessary Privileges - (250)
Weakness BaseWeakness Base Expired Pointer Dereference - (825)
Weakness ClassWeakness Class Improper Check for Unusual or Exceptional Conditions - (754)
Weakness BaseWeakness Base Improper Cross-boundary Removal of Sensitive Data - (212)
Weakness BaseWeakness Base Improper Enforcement of Behavioral Workflow - (841)
Weakness ClassWeakness Class Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - (22)
Weakness BaseWeakness Base Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - (79)
Weakness BaseWeakness Base Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - (78)
Weakness BaseWeakness Base Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - (89)
Weakness BaseWeakness Base Improper Restriction of Excessive Authentication Attempts - (307)
Weakness BaseWeakness Base Improper Validation of Array Index - (129)
Weakness BaseWeakness Base Inappropriate Encoding for Output Context - (838)
Weakness ClassWeakness Class Inclusion of Functionality from Untrusted Control Sphere - (829)
Weakness ClassWeakness Class Incorrect Authorization - (863)
Weakness BaseWeakness Base Incorrect Calculation of Buffer Size - (131)
Weakness BaseWeakness Base Incorrect Conversion between Numeric Types - (681)
Weakness ClassWeakness Class Incorrect Permission Assignment for Critical Resource - (732)
Weakness BaseWeakness Base Information Exposure Through an Error Message - (209)
Weakness BaseWeakness Base Integer Overflow or Wraparound - (190)
Weakness VariantWeakness Variant Missing Authentication for Critical Function - (306)
Weakness ClassWeakness Class Missing Authorization - (862)
Weakness BaseWeakness Base Missing Encryption of Sensitive Data - (311)
Weakness BaseWeakness Base Missing Initialization - (456)
Weakness BaseWeakness Base Missing Release of Resource after Effective Lifetime - (772)
Weakness BaseWeakness Base NULL Pointer Dereference - (476)
Weakness BaseWeakness Base Reliance on Untrusted Inputs in a Security Decision - (807)
Weakness BaseWeakness Base Uncontrolled Format String - (134)
Weakness BaseWeakness Base Unrestricted Upload of File with Dangerous Type - (434)
Weakness BaseWeakness Base Untrusted Pointer Dereference - (822)
Weakness VariantWeakness Variant URL Redirection to Untrusted Site ('Open Redirect') - (601)
Weakness BaseWeakness Base Use of a Broken or Risky Cryptographic Algorithm - (327)
Weakness ClassWeakness Class Use of a One-Way Hash without a Salt - (759)
Weakness BaseWeakness Base Use of Hard-coded Credentials - (798)
Weakness ClassWeakness Class Use of Insufficiently Random Values - (330)
Weakness BaseWeakness Base Use of Potentially Dangerous Function - (676)
Page Last Updated: May 14, 2012