2010 Top 25 - Insecure Interaction Between Components

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource...

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated...

The product generates an error message that includes sensitive information about its environment, users, or associated data.

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes...

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralize...

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is availa...