2308
[REF-1398]The Clang Team. "Control Flow Integrity". < https://clang.llvm.org/docs/
ControlFlowIntegrity.html >.2024-02-13.
[REF-1389]Alyssa Milburn, Ke Sun and Henrique Kawakami. "You Cannot Always Win the Race:
Analyzing the LFENCE/JMP Mitigation for Branch Target Injection". 2022 March 8. < https://
arxiv.org/abs/2203.04277 >.2024-02-22.
[REF-1400]Intel Corporation. "Refined Speculative Execution Terminology". 2022 March 1. <
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/
best-practices/refined-speculative-execution-terminology.html >.2024-02-13.
[REF-1401]Neta Bar Kama and Roope Kaivola. "Hardware Security Leak Detection by Symbolic
Simulation". 2021 November. < https://ieeexplore.ieee.org/document/9617727 >.2024-02-13.
Categories
Category-2: 7PK - Environment
Category ID : 2
Summary
This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability
classification. It includes weaknesses that are typically introduced during unexpected
environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This
section includes everything that is outside of the source code but is still critical to the security of the
product that is being created. Because the issues covered by this kingdom are not directly related
to source code, we separated it from the rest of the kingdoms."
Membership
Nature Type ID Name Page
MemberOf 700 Seven Pernicious Kingdoms 700 2557
MemberOf 933 OWASP Top Ten 2013 Category A5 - Security
Misconfiguration
928 2391
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security
Misconfiguration
1344 2493
HasMember 5 J2EE Misconfiguration: Data Transmission Without
Encryption
700 1
HasMember 6 J2EE Misconfiguration: Insufficient Session-ID Length 700 2
HasMember 7 J2EE Misconfiguration: Missing Custom Error Page 700 4
HasMember 8 J2EE Misconfiguration: Entity Bean Declared Remote 700 6
HasMember 9 J2EE Misconfiguration: Weak Access Permissions for
EJB Methods
700 8
HasMember 11 ASP.NET Misconfiguration: Creating Debug Binary 700 9
HasMember 12 ASP.NET Misconfiguration: Missing Custom Error Page 700 11
HasMember 13 ASP.NET Misconfiguration: Password in Configuration
File
700 13
HasMember 14 Compiler Removal of Code to Clear Buffers 700 14
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
CWE Version 4.14
CWE-16: Configuration
CWE-16: Configuration