2443
Nature Type ID Name Page
HasMember 672 Operation on a Resource after Expiration or Release 1128 1479
HasMember 681 Incorrect Conversion between Numeric Types 1128 1495
HasMember 772 Missing Release of Resource after Effective Lifetime 1128 1624
HasMember 789 Memory Allocation with Excessive Size Value 1128 1674
HasMember 798 Use of Hard-coded Credentials 1128 1690
HasMember 835 Loop with Unreachable Exit Condition ('Infinite Loop') 1128 1757
References
[REF-962]Object Management Group (OMG). "Automated Source Code Security Measure
(ASCSM)". 2016 January. < http://www.omg.org/spec/ASCSM/1.0/ >.
[REF-968]Consortium for Information & Software Quality (CISQ). "Automated Quality Characteristic
Measures". 2016. < http://it-cisq.org/standards/automated-quality-characteristic-measures/ >.
Category-1132: CISQ Quality Measures (2016) - Performance Efficiency
Category ID : 1132
Summary
Weaknesses in this category are related to the CISQ Quality Measures for Performance Efficiency,
as documented in 2016 with the Automated Source Code Performance Efficiency Measure
(ASCPEM) Specification 1.0. Presence of these weaknesses could reduce the performance
efficiency of the software.
Membership
Nature Type ID Name Page
MemberOf 1128 CISQ Quality Measures (2016) 1128 2581
HasMember 1042 Static Member Data Element outside of a Singleton
Class Element
1128 1876
HasMember 1043 Data Element Aggregating an Excessively Large
Number of Non-Primitive Elements
1128 1877
HasMember 1046 Creation of Immutable Text Using String Concatenation 1128 1881
HasMember 1049 Excessive Data Query Operations in a Large Data
Table
1128 1884
HasMember 1050 Excessive Platform Resource Consumption within a
Loop
1128 1885
HasMember 1057 Data Access Operations Outside of Expected Data
Manager Component
1128 1892
HasMember 1060 Excessive Number of Inefficient Server-Side Data
Accesses
1128 1897
HasMember 1063 Creation of Class Instance within a Static Code Block 1128 1901
HasMember 1067 Excessive Execution of Sequential Searches of Data
Resource
1128 1905
HasMember 1072 Data Resource Access without Use of Connection
Pooling
1128 1912
HasMember 1073 Non-SQL Invokable Control Element with Excessive
Number of Data Resource Accesses
1128 1913
HasMember 1089 Large Data Table with Excessive Number of Indices 1128 1929
HasMember 1091 Use of Object without Invoking Destructor Method 1128 1931
HasMember 1094 Excessive Index Range Scan for a Data Resource 1128 1934
References
CWE Version 4.14
CWE-1134: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and
Data Sanitization (IDS)
CWE-1134: SEI CERT Oracle Secure Coding Standard for Java
- Guidelines 00. Input Validation and Data Sanitization (IDS) 2444
[REF-959]Object Management Group (OMG). "Automated Source Code Performance Efficiency
Measure (ASCPEM)". 2016 January. < https://www.omg.org/spec/ASCPEM/ >.2023-04-07.
[REF-968]Consortium for Information & Software Quality (CISQ). "Automated Quality Characteristic
Measures". 2016. < http://it-cisq.org/standards/automated-quality-characteristic-measures/ >.
Category-1134: SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 00. Input Validation and Data Sanitization (IDS)
Category ID : 1134
Summary
Weaknesses in this category are related to the rules and recommendations in the Input Validation
and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.
Membership
Nature Type ID Name Page
MemberOf 1133 Weaknesses Addressed by the SEI CERT Oracle
Coding Standard for Java
1133 2582
HasMember 78 Improper Neutralization of Special Elements used in an
OS Command ('OS Command Injection')
1133 151
HasMember 116 Improper Encoding or Escaping of Output 1133 281
HasMember 117 Improper Output Neutralization for Logs 1133 288
HasMember 134 Use of Externally-Controlled Format String 1133 365
HasMember 144 Improper Neutralization of Line Delimiters 1133 383
HasMember 150 Improper Neutralization of Escape, Meta, or Control
Sequences
1133 394
HasMember 180 Incorrect Behavior Order: Validate Before Canonicalize 1133 451
HasMember 182 Collapse of Data into Unsafe Value 1133 455
HasMember 289 Authentication Bypass by Alternate Name 1133 703
HasMember 409 Improper Handling of Highly Compressed Data (Data
Amplification)
1133 996
References
[REF-814]The Software Engineering Institute. "SEI CERT Oracle Coding Standard for Java : Rule
00. Input Validation and Data Sanitization (IDS)". < https://wiki.sei.cmu.edu/confluence/pages/
viewpage.action?pageId=88487865 >.
[REF-996]The Software Engineering Institute. "SEI CERT Oracle Coding Standard for Java : Rec
00. Input Validation and Data Sanitization (IDS)". < https://wiki.sei.cmu.edu/confluence/pages/
viewpage.action?pageId=88487337 >.
Category-1135: SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 01. Declarations and Initialization (DCL)
Category ID : 1135
Summary
Weaknesses in this category are related to the rules and recommendations in the Declarations and
Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java.
Membership
CWE Version 4.14
CWE-1136: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP)
CWE-1136: SEI CERT Oracle Secure Coding
Standard for Java - Guidelines 02. Expressions (EXP)