Vendors and Products

Vendors List

Products List

CPE, which stands for Common Platform Enumeration, is a standardized scheme for naming hardware, software, and operating systems. CPE provides a structured naming scheme to uniquely identify and classify information technology systems, platforms, and packages based on certain attributes such as vendor, product name, version, update, edition, and language.

CWE-1337

Name

Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses

Status

Stable

Type

Graph

Published

2021-06-22 +00:00

Last Modified

2023-06-29 +00:00

Official links

Alerte pour un CWE

Stay informed of any changes for a specific CWE.

Alert management

List of Alerts

Alerte pour un CWE

Stay informed of any changes for a specific CWE.

Parameters

You can specify a title that will be retrieved in the alerts that will be sent out.

Specify the CWE ID you wish to monitor.

Planning

Month

Next run calculation

Day

Weekday

Hour

Minute

Creation date

-

Last execution

-

Next execution

-

Functionality requiring a connection

This feature, which allows you to receive alerts, is only active when you are logged into your account.

Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

Members

CWE-787: Out-of-bounds Write Base

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Base

CWE-125: Out-of-bounds Read Base

CWE-20: Improper Input Validation Base

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Base

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Base

CWE-416: Use After Free Base

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Base

CWE-352: Cross-Site Request Forgery (CSRF) Base

CWE-434: Unrestricted Upload of File with Dangerous Type Base

CWE-306: Missing Authentication for Critical Function Base

CWE-190: Integer Overflow or Wraparound Base

CWE-502: Deserialization of Untrusted Data Base

CWE-287: Improper Authentication Base

CWE-476: NULL Pointer Dereference Base

CWE-798: Use of Hard-coded Credentials Base

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer Base

CWE-862: Missing Authorization Base

CWE-276: Incorrect Default Permissions Base

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Base

CWE-522: Insufficiently Protected Credentials Base

CWE-732: Incorrect Permission Assignment for Critical Resource Base

CWE-611: Improper Restriction of XML External Entity Reference Base

CWE-918: Server-Side Request Forgery (SSRF) Base

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') Base

Informations

Vulnerability Mapping Notes

Rationale : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Comments : Use this View or other Views to search and navigate for the appropriate weakness.

Audience

Stakeholder	Description
Software Developers	By following the CWE Top 25, developers are able to significantly reduce the number of weaknesses that occur in their software.
Product Customers	Customers can use the weaknesses in this view in order to formulate independent evidence of a claim by a product vendor to have eliminated / mitigated the most dangerous weaknesses.
Educators	Educators can use this view to focus curriculum and teachings on the most dangerous weaknesses.

Submission

Name	Organization	Date	Date Release	Version
CWE Content Team	MITRE	2021-06-22 +00:00	2021-07-20 +00:00	4.5

Modifications

Name	Organization	Date	Comment
CWE Content Team	MITRE	2021-10-28 +00:00	updated View_Audience
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes

References

REF-1185

2021 CWE Top 25 Most Dangerous Software Weaknesses
http://cwe.mitre.org/top25/archive/2021/2021_cwe_top25.html