CWE/SANS sta objavila dokument Top 25 programerskih napak, katerih posledica so lahko kritične varnostne pomanjkljivosti v aplikativni opremi. Lestvica je v marsičem podobna OWASP-ovi Top Ten varnostnih pomanjkljivosti v spletnih aplikacijah. Ugotovitve ne presenečajo, pomanjkljivosti so nam že dolgo znane, pa vendar marsikatera, tudi nova aplikacija na njih ni imuna. Spodaj je lista napak s povezavami na podrobnejše opise.
|
Rank |
Score |
ID |
Name |
|---|---|---|---|
|
[1] |
93.8 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
|
|
[2] |
83.3 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
|
|
[3] |
79.0 |
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
|
|
[4] |
77.7 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
|
|
[5] |
76.9 |
Missing Authentication for Critical Function |
|
|
[6] |
76.8 |
Missing Authorization |
|
|
[7] |
75.0 |
Use of Hard-coded Credentials |
|
|
[8] |
75.0 |
Missing Encryption of Sensitive Data |
|
|
[9] |
74.0 |
Unrestricted Upload of File with Dangerous Type |
|
|
[10] |
73.8 |
Reliance on Untrusted Inputs in a Security Decision |
|
|
[11] |
73.1 |
Execution with Unnecessary Privileges |
|
|
[12] |
70.1 |
Cross-Site Request Forgery (CSRF) |
|
|
[13] |
69.3 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
|
|
[14] |
68.5 |
Download of Code Without Integrity Check |
|
|
[15] |
67.8 |
Incorrect Authorization |
|
|
[16] |
66.0 |
Inclusion of Functionality from Untrusted Control Sphere |
|
|
[17] |
65.5 |
Incorrect Permission Assignment for Critical Resource |
|
|
[18] |
64.6 |
Use of Potentially Dangerous Function |
|
|
[19] |
64.1 |
Use of a Broken or Risky Cryptographic Algorithm |
|
|
[20] |
62.4 |
Incorrect Calculation of Buffer Size |
|
|
[21] |
61.5 |
Improper Restriction of Excessive Authentication Attempts |
|
|
[22] |
61.1 |
URL Redirection to Untrusted Site ('Open Redirect') |
|
|
[23] |
61.0 |
Uncontrolled Format String |
|
|
[24] |
60.3 |
Integer Overflow or Wraparound |
|
|
[25] |
59.9 |
Use of a One-Way Hash without a Salt |
