886
Nature Type ID Name Page
MemberOf 1029 OWASP Top Ten 2017 Category A3 - Sensitive Data
Exposure
1026 2436
MemberOf 1147 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 13. Input Output (FIO)
1133 2450
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Notes
Maintenance
This entry overlaps many other entries that are not organized around the kind of sensitive
information that is exposed. However, because privacy is treated with such importance due
to regulations and other factors, and it may be useful for weakness-finding tools to highlight
capabilities that detect personal private information instead of system information, it is not clear
whether - and how - this entry should be deprecated.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Privacy Violation
The CERT Oracle Secure
Coding Standard for Java
(2011)
FIO13-J Do not log sensitive information outside
a trust boundary
Related Attack Patterns
CAPEC-ID Attack Pattern Name
464 Evercookie
467 Cross Site Identification
498 Probe iOS Screenshots
508 Shoulder Surfing
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-338]J. Oates. "AOL man pleads guilty to selling 92m email addies". The Register. 2005. <
https://www.theregister.com/2005/02/07/aol_email_theft/ >.2023-04-07.
[REF-339]NIST. "Guide to Protecting the Confidentiality of Personally Identifiable
Information (SP 800-122)". 2010 April. < https://nvlpubs.nist.gov/nistpubs/Legacy/SP/
nistspecialpublication800-122.pdf >.2023-04-07.
[REF-340]U.S. Department of Commerce. "Safe Harbor Privacy Framework". < https://
web.archive.org/web/20010223203241/http://www.export.gov/safeharbor/ >.2023-04-07.
[REF-341]Federal Trade Commission. "Financial Privacy: The Gramm-Leach Bliley Act (GLBA)". <
https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act >.2023-04-07.
[REF-342]U.S. Department of Human Services. "Health Insurance Portability and Accountability Act
(HIPAA)". < https://www.hhs.gov/hipaa/index.html >.2023-04-07.
[REF-343]Government of the State of California. "California SB-1386". 2002. < http://
info.sen.ca.gov/pub/01-02/bill/sen/sb_1351-1400/sb_1386_bill_20020926_chaptered.html >.
CWE Version 4.14
CWE-360: Trust of System Event Data
CWE-360: Trust of System Event Data