2421
Nature Type ID Name Page
HasMember 758 Reliance on Undefined, Unspecified, or Implementation-
Defined Behavior
888 1582
Category-1002: SFP Secondary Cluster: Unexpected Entry Points
Category ID : 1002
Summary
This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.
Membership
Nature Type ID Name Page
MemberOf 897 SFP Primary Cluster: Entry Points 888 2385
HasMember 489 Active Debug Code 888 1171
HasMember 491 Public cloneable() Method Without Final ('Object Hijack') 888 1174
HasMember 493 Critical Public Variable Without Final Modifier 888 1182
HasMember 500 Public Static Field Not Marked Final 888 1200
HasMember 531 Inclusion of Sensitive Information in Test Code 888 1240
HasMember 568 finalize() Method Without super.finalize() 888 1290
HasMember 580 clone() Method Without super.clone() 888 1311
HasMember 582 Array Declared Public, Final, and Static 888 1314
HasMember 583 finalize() Method Declared Public 888 1315
HasMember 608 Struts: Non-private Field in ActionForm Class 888 1361
HasMember 766 Critical Data Element Declared Public 888 1607
Category-1005: 7PK - Input Validation and Representation
Category ID : 1005
Summary
This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability
classification. It includes weaknesses that exist when an application does not properly validate
or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation
and representation problems are caused by metacharacters, alternate encodings and numeric
representations. Security problems result from trusting input."
Membership
Nature Type ID Name Page
MemberOf 700 Seven Pernicious Kingdoms 700 2557
HasMember 20 Improper Input Validation 700 20
HasMember 77 Improper Neutralization of Special Elements used in a
Command ('Command Injection')
700 145
HasMember 79 Improper Neutralization of Input During Web Page
Generation ('Cross-site Scripting')
700 163
HasMember 89 Improper Neutralization of Special Elements used in an
SQL Command ('SQL Injection')
700 201
HasMember 99 Improper Control of Resource Identifiers ('Resource
Injection')
700 243
CWE Version 4.14
CWE-1006: Bad Coding Practices
CWE-1006: Bad Coding Practices