Product

Pricing

Developers

Resources

Contact

Home

CWE List

Seven Pernicious Kingdoms

View: Seven Pernicious Kingdoms

Incomplete

Type: Graph

Objective

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

Audience

Type	Description
Software Developers	This view is useful for developers because it is organized around concepts with which developers are familiar, and it focuses on weaknesses that can be detected using source code analysis tools.

Relationships

Seven Pernicious Kingdoms- (CWE-700)

7PK - Security Features- (CWE-254)

Plaintext Storage of a Password- (CWE-256)

Empty Password in Configuration File- (CWE-258)

Use of Hard-coded Password- (CWE-259)

Password in Configuration File- (CWE-260)

Weak Encoding for Password- (CWE-261)

Least Privilege Violation- (CWE-272)

Improper Access Control- (CWE-284)

Improper Authorization- (CWE-285)

Use of Insufficiently Random Values- (CWE-330)

Exposure of Private Personal Information to an Unauthorized Actor- (CWE-359)

Use of Hard-coded Credentials- (CWE-798)

7PK - Time and State- (CWE-361)

Signal Handler Race Condition- (CWE-364)

Time-of-check Time-of-use (TOCTOU) Race Condition- (CWE-367)

Insecure Temporary File- (CWE-377)

J2EE Bad Practices: Use of System.exit()- (CWE-382)

J2EE Bad Practices: Direct Use of Threads- (CWE-383)

Session Fixation- (CWE-384)

Unrestricted Externally Accessible Lock- (CWE-412)

7PK - Errors- (CWE-388)

Unchecked Error Condition- (CWE-391)

Use of NullPointerException Catch to Detect NULL Pointer Dereference- (CWE-395)

Declaration of Catch for Generic Exception- (CWE-396)

Declaration of Throws for Generic Exception- (CWE-397)

7PK - Input Validation and Representation- (CWE-1005)

Improper Input Validation- (CWE-20)

Improper Neutralization of Special Elements used in a Command ('Command Injection')- (CWE-77)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')- (CWE-79)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')- (CWE-89)

Improper Control of Resource Identifiers ('Resource Injection')- (CWE-99)

7PK - API Abuse- (CWE-227)

Use of Inherently Dangerous Function- (CWE-242)

Creation of chroot Jail Without Changing Working Directory- (CWE-243)

Improper Clearing of Heap Memory Before Release ('Heap Inspection')- (CWE-244)

J2EE Bad Practices: Direct Management of Connections- (CWE-245)

J2EE Bad Practices: Direct Use of Sockets- (CWE-246)

Uncaught Exception- (CWE-248)

Execution with Unnecessary Privileges- (CWE-250)

Often Misused: String Management- (CWE-251)

Unchecked Return Value- (CWE-252)

Use of getlogin() in Multithreaded Application- (CWE-558)

7PK - Code Quality- (CWE-398)

Missing Release of Memory after Effective Lifetime- (CWE-401)

Improper Resource Shutdown or Release- (CWE-404)

Double Free- (CWE-415)

Use After Free- (CWE-416)

Use of Uninitialized Variable- (CWE-457)

Use of Function with Inconsistent Implementations- (CWE-474)

Undefined Behavior for Input to API- (CWE-475)

NULL Pointer Dereference- (CWE-476)

Use of Obsolete Function- (CWE-477)

7PK - Encapsulation- (CWE-485)

Comparison of Classes by Name- (CWE-486)

Exposure of Data Element to Wrong Session- (CWE-488)

Active Debug Code- (CWE-489)

Public cloneable() Method Without Final ('Object Hijack')- (CWE-491)

Use of Inner Class Containing Sensitive Data- (CWE-492)

Critical Public Variable Without Final Modifier- (CWE-493)

Private Data Structure Returned From A Public Method- (CWE-495)

Public Data Assigned to Private Array-Typed Field- (CWE-496)

Exposure of Sensitive System Information to an Unauthorized Control Sphere- (CWE-497)

Trust Boundary Violation- (CWE-501)

7PK - Environment- (CWE-2)

ASP.NET Misconfiguration: Creating Debug Binary- (CWE-11)

ASP.NET Misconfiguration: Missing Custom Error Page- (CWE-12)

ASP.NET Misconfiguration: Password in Configuration File- (CWE-13)

Compiler Removal of Code to Clear Buffers- (CWE-14)

J2EE Misconfiguration: Data Transmission Without Encryption- (CWE-5)

J2EE Misconfiguration: Insufficient Session-ID Length- (CWE-6)

J2EE Misconfiguration: Missing Custom Error Page- (CWE-7)

J2EE Misconfiguration: Entity Bean Declared Remote- (CWE-8)

J2EE Misconfiguration: Weak Access Permissions for EJB Methods- (CWE-9)

Mapping Notes

Usage: Prohibited

Reasons: View

Rationale:

This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.

Comment:

Use this View or other Views to search and navigate for the appropriate weakness.

Elevate your cybersecurity strategy with Plexicus

Twitter LinkedIn GitHub Instagram

Products

ASPM
CSPM
Container Security

Resources

Blog
Glossary
Documentation
Free SAST Tool
Changelogs
Integrations
Comparison Overview
CWE Database
Software Security Tools Guide

Company

Contact
Privacy Policy
Pricing
Management Policy
Legal Notice
Cookie Policy
Terms of Use
Support

Cookie Preferences

SOC2 Type IICompliant