2433
Chromium, PHP and Thunderbird.". 2017 IEEE International Conference on Software Architecture
(ICSA). 2017. < https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf >.
Category-1019: Validate Inputs
Category ID : 1019
Summary
Weaknesses in this category are related to the design and architecture of a system's input
validation components. Frequently these deal with sanitizing, neutralizing and validating any
externally provided inputs to minimize malformed data from entering the system and preventing
code injection in the input data. The weaknesses in this category could lead to a degradation of the
quality of data flow in a system if they are not addressed when designing or implementing a secure
architecture.
Membership
Nature Type ID Name Page
MemberOf 1008 Architectural Concepts 1008 2577
HasMember 20 Improper Input Validation 1008 20
HasMember 59 Improper Link Resolution Before File Access ('Link
Following')
1008 111
HasMember 74 Improper Neutralization of Special Elements in Output
Used by a Downstream Component ('Injection')
1008 137
HasMember 75 Failure to Sanitize Special Elements into a Different
Plane (Special Element Injection)
1008 142
HasMember 76 Improper Neutralization of Equivalent Special Elements 1008 144
HasMember 77 Improper Neutralization of Special Elements used in a
Command ('Command Injection')
1008 145
HasMember 78 Improper Neutralization of Special Elements used in an
OS Command ('OS Command Injection')
1008 151
HasMember 79 Improper Neutralization of Input During Web Page
Generation ('Cross-site Scripting')
1008 163
HasMember 88 Improper Neutralization of Argument Delimiters in a
Command ('Argument Injection')
1008 194
HasMember 89 Improper Neutralization of Special Elements used in an
SQL Command ('SQL Injection')
1008 201
HasMember 90 Improper Neutralization of Special Elements used in an
LDAP Query ('LDAP Injection')
1008 212
HasMember 91 XML Injection (aka Blind XPath Injection) 1008 215
HasMember 93 Improper Neutralization of CRLF Sequences ('CRLF
Injection')
1008 217
HasMember 94 Improper Control of Generation of Code ('Code
Injection')
1008 219
HasMember 95 Improper Neutralization of Directives in Dynamically
Evaluated Code ('Eval Injection')
1008 226
HasMember 96 Improper Neutralization of Directives in Statically Saved
Code ('Static Code Injection')
1008 232
HasMember 97 Improper Neutralization of Server-Side Includes (SSI)
Within a Web Page
1008 235
HasMember 98 Improper Control of Filename for Include/Require
Statement in PHP Program ('PHP Remote File
Inclusion')
1008 236
CWE Version 4.14
CWE-1020: Verify Message Integrity
CWE-1020: Verify Message Integrity