2434
Nature Type ID Name Page
HasMember 99 Improper Control of Resource Identifiers ('Resource
Injection')
1008 243
HasMember 138 Improper Neutralization of Special Elements 1008 373
HasMember 150 Improper Neutralization of Escape, Meta, or Control
Sequences
1008 394
HasMember 349 Acceptance of Extraneous Untrusted Data With Trusted
Data
1008 861
HasMember 352 Cross-Site Request Forgery (CSRF) 1008 868
HasMember 472 External Control of Assumed-Immutable Web
Parameter
1008 1123
HasMember 473 PHP External Variable Modification 1008 1127
HasMember 502 Deserialization of Untrusted Data 1008 1204
HasMember 601 URL Redirection to Untrusted Site ('Open Redirect') 1008 1345
HasMember 641 Improper Restriction of Names for Files and Other
Resources
1008 1412
HasMember 643 Improper Neutralization of Data within XPath
Expressions ('XPath Injection')
1008 1419
HasMember 652 Improper Neutralization of Data within XQuery
Expressions ('XQuery Injection')
1008 1435
HasMember 790 Improper Filtering of Special Elements 1008 1678
HasMember 791 Incomplete Filtering of Special Elements 1008 1680
HasMember 792 Incomplete Filtering of One or More Instances of
Special Elements
1008 1681
HasMember 793 Only Filtering One Instance of a Special Element 1008 1683
HasMember 794 Incomplete Filtering of Multiple Instances of Special
Elements
1008 1684
HasMember 795 Only Filtering Special Elements at a Specified Location 1008 1685
HasMember 796 Only Filtering Special Elements Relative to a Marker 1008 1687
HasMember 797 Only Filtering Special Elements at an Absolute Position 1008 1689
HasMember 943 Improper Neutralization of Special Elements in Data
Query Logic
1008 1850
References
[REF-9]Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture
Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <
https://design.se.rit.edu/papers/cawe-paper.pdf >.
[REF-10]Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding
Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of
Chromium, PHP and Thunderbird.". 2017 IEEE International Conference on Software Architecture
(ICSA). 2017. < https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf >.
Category-1020: Verify Message Integrity
Category ID : 1020
Summary
Weaknesses in this category are related to the design and architecture of a system's data integrity
components. Frequently these deal with ensuring integrity of data, such as messages, resource
files, deployment files, and configuration files. The weaknesses in this category could lead to a
CWE Version 4.14
CWE-1027: OWASP Top Ten 2017 Category A1 - Injection
CWE-1027: OWASP Top Ten 2017 Category A1 - Injection