View: Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses

Stable

Type: Graph

Objective

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

Audience

Type	Description
Software Developers	By following the CWE Top 25, developers are able to significantly reduce the number of weaknesses that occur in their software.
Product Customers	Customers can use the weaknesses in this view in order to formulate independent evidence of a claim by a product vendor to have eliminated / mitigated the most dangerous weaknesses.
Educators	Educators can use this view to focus curriculum and teachings on the most dangerous weaknesses.

Relationships

Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses- (CWE-1350)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')- (CWE-79)

Out-of-bounds Write- (CWE-787)

Improper Input Validation- (CWE-20)

Out-of-bounds Read- (CWE-125)

Improper Restriction of Operations within the Bounds of a Memory Buffer- (CWE-119)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')- (CWE-89)

Exposure of Sensitive Information to an Unauthorized Actor- (CWE-200)

Use After Free- (CWE-416)

Cross-Site Request Forgery (CSRF)- (CWE-352)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')- (CWE-78)

Integer Overflow or Wraparound- (CWE-190)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')- (CWE-22)

NULL Pointer Dereference- (CWE-476)

Improper Authentication- (CWE-287)

Unrestricted Upload of File with Dangerous Type- (CWE-434)

Incorrect Permission Assignment for Critical Resource- (CWE-732)

Improper Control of Generation of Code ('Code Injection')- (CWE-94)

Insufficiently Protected Credentials- (CWE-522)

Improper Restriction of XML External Entity Reference- (CWE-611)

Use of Hard-coded Credentials- (CWE-798)

Deserialization of Untrusted Data- (CWE-502)

Improper Privilege Management- (CWE-269)

Uncontrolled Resource Consumption- (CWE-400)

Missing Authentication for Critical Function- (CWE-306)

Missing Authorization- (CWE-862)

Mapping Notes

Usage: Prohibited

Reasons: View

Rationale:

This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.

Comment:

Use this View or other Views to search and navigate for the appropriate weakness.