2427
Nature Type ID Name Page
HasMember 566 Authorization Bypass Through User-Controlled SQL
Primary Key
1008 1286
HasMember 639 Authorization Bypass Through User-Controlled Key 1008 1406
HasMember 642 External Control of Critical State Data 1008 1414
HasMember 647 Use of Non-Canonical URL Paths for Authorization
Decisions
1008 1426
HasMember 653 Improper Isolation or Compartmentalization 1008 1437
HasMember 656 Reliance on Security Through Obscurity 1008 1444
HasMember 668 Exposure of Resource to Wrong Sphere 1008 1469
HasMember 669 Incorrect Resource Transfer Between Spheres 1008 1471
HasMember 671 Lack of Administrator Control over Security 1008 1478
HasMember 673 External Influence of Sphere Definition 1008 1483
HasMember 708 Incorrect Ownership Assignment 1008 1548
HasMember 732 Incorrect Permission Assignment for Critical Resource 1008 1551
HasMember 770 Allocation of Resources Without Limits or Throttling 1008 1613
HasMember 782 Exposed IOCTL with Insufficient Access Control 1008 1648
HasMember 827 Improper Control of Document Type Definition 1008 1736
HasMember 862 Missing Authorization 1008 1780
HasMember 863 Incorrect Authorization 1008 1787
HasMember 921 Storage of Sensitive Data in a Mechanism without
Access Control
1008 1824
HasMember 923 Improper Restriction of Communication Channel to
Intended Endpoints
1008 1827
HasMember 939 Improper Authorization in Handler for Custom URL
Scheme
1008 1840
HasMember 942 Permissive Cross-domain Policy with Untrusted
Domains
1008 1847
References
[REF-9]Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture
Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <
https://design.se.rit.edu/papers/cawe-paper.pdf >.
[REF-10]Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding
Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of
Chromium, PHP and Thunderbird.". 2017 IEEE International Conference on Software Architecture
(ICSA). 2017. < https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf >.
Category-1012: Cross Cutting
Category ID : 1012
Summary
Weaknesses in this category are related to the design and architecture of multiple security tactics
and how they affect a system. For example, information exposure can impact the Limit Access and
Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the
quality of many capabilities if they are not addressed when designing or implementing a secure
architecture.
Membership
CWE Version 4.14
CWE-1013: Encrypt Data
CWE-1013: Encrypt Data