2429
Nature Type ID Name Page
HasMember 324 Use of a Key Past its Expiration Date 1008 792
HasMember 325 Missing Cryptographic Step 1008 794
HasMember 326 Inadequate Encryption Strength 1008 796
HasMember 327 Use of a Broken or Risky Cryptographic Algorithm 1008 799
HasMember 328 Use of Weak Hash 1008 806
HasMember 330 Use of Insufficiently Random Values 1008 814
HasMember 331 Insufficient Entropy 1008 821
HasMember 332 Insufficient Entropy in PRNG 1008 823
HasMember 333 Improper Handling of Insufficient Entropy in TRNG 1008 825
HasMember 334 Small Space of Random Values 1008 827
HasMember 335 Incorrect Usage of Seeds in Pseudo-Random Number
Generator (PRNG)
1008 829
HasMember 336 Same Seed in Pseudo-Random Number Generator
(PRNG)
1008 832
HasMember 337 Predictable Seed in Pseudo-Random Number
Generator (PRNG)
1008 834
HasMember 338 Use of Cryptographically Weak Pseudo-Random
Number Generator (PRNG)
1008 837
HasMember 339 Small Seed Space in PRNG 1008 840
HasMember 347 Improper Verification of Cryptographic Signature 1008 857
HasMember 522 Insufficiently Protected Credentials 1008 1225
HasMember 523 Unprotected Transport of Credentials 1008 1230
HasMember 757 Selection of Less-Secure Algorithm During Negotiation
('Algorithm Downgrade')
1008 1581
HasMember 759 Use of a One-Way Hash without a Salt 1008 1585
HasMember 760 Use of a One-Way Hash with a Predictable Salt 1008 1589
HasMember 780 Use of RSA Algorithm without OAEP 1008 1644
HasMember 922 Insecure Storage of Sensitive Information 1008 1825
References
[REF-9]Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture
Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <
https://design.se.rit.edu/papers/cawe-paper.pdf >.
[REF-10]Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding
Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of
Chromium, PHP and Thunderbird.". 2017 IEEE International Conference on Software Architecture
(ICSA). 2017. < https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf >.
Category-1014: Identify Actors
Category ID : 1014
Summary
Weaknesses in this category are related to the design and architecture of a system's identification
management components. Frequently these deal with verifying that external agents provide inputs
into the system. The weaknesses in this category could lead to a degradation of the quality of
identification management if they are not addressed when designing or implementing a secure
architecture.
Membership
CWE Version 4.14
CWE-1015: Limit Access
CWE-1015: Limit Access