2011 CWE/SANS top 25 most dangerous software errors

SANS and Mitre have released the CWE/SANS Top 25 Most Dangerous Software Errors list for 2011.

The list was compiled with the help of a great number of security experts from a variety of security firms and organizations, and NSA and DHS cyber security divisions.

The list reads as follows:

1. Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) – CWE-89

2. Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) – CWE-78

3. Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) – CWE-120

4. Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) – CWE-79

5. Missing Authentication for Critical Function – CWE-306

6. Missing Authorization – CWE-862

7. Use of Hard-coded Credentials – CWE-798

8. Missing Encryption of Sensitive Data – CWE-311

9. Unrestricted Upload of File with Dangerous Type – CWE-434

10. Reliance on Untrusted Inputs in a Security Decision – CWE-807

11. Execution with Unnecessary Privileges – CWE-250

12. Cross-Site Request Forgery (CSRF) – CWE-352

13. Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) – CWE-22

14. Download of Code Without Integrity Check – CWE-494

15. Incorrect Authorization – CWE-863

16. Inclusion of Functionality from Untrusted Control Sphere – CWE-829

17. Incorrect Permission Assignment for Critical Resource – CWE-732

18. Use of Potentially Dangerous Function – CWE-676

19. Use of a Broken or Risky Cryptographic Algorithm – CWE-327

20. Incorrect Calculation of Buffer Size – CWE-131

21. Improper Restriction of Excessive Authentication Attempts – CWE-307

22. URL Redirection to Untrusted Site (‘Open Redirect’) – CWE-601

23. Uncontrolled Format String – CWE-134

24. Integer Overflow or Wraparound – CWE-190

25. Use of a One-Way Hash without a Salt – CWE-759.

For more details, download the PDF file.




Share this