Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors
A view in the Common Weakness Enumeration published by The MITRE Corporation.
Objective
Views in the Common Weakness Enumeration (CWE) represent one perspective with which to consider a set of weaknesses.
CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.
Target Audience
Educators
Educators can use this view in multiple ways. For example, if there is a focus on teaching weaknesses, the educator could focus on the Top 25.
Product Customers
If a software developer claims to be following the Top 25, then customers can use the weaknesses in this view in order to formulate independent evidence of that claim.
Software Developers
By following the Top 25, developers will be able to significantly reduce the number of weaknesses that occur in their software.
Weaknesses
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated...
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
The product does not validate, or incorrectly validates, a certificate.
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralize...
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process th...
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but ...
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes...
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralize...
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or...
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product ...
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be ...
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
The product dereferences a pointer that it expects to be valid but is NULL.
The product reads data past the end, or before the beginning, of the intended buffer.
The product writes data past the end, or before the beginning, of the intended buffer.
The product does not properly control the allocation and maintenance of a limited resource.
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the ori...
The product contains hard-coded credentials, such as a password or cryptographic key.
See Also
Common Weakness Enumeration content on this website is copyright of The MITRE Corporation unless otherwise specified. Use of the Common Weakness Enumeration and the associated references on this website are subject to the Terms of Use as specified by The MITRE Corporation.