2369
Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT
Oracle Secure Coding Standard for Java (2011).
Membership
Nature Type ID Name Page
MemberOf 844 Weaknesses Addressed by The CERT Oracle Secure
Coding Standard for Java (2011)
844 2564
HasMember 250 Execution with Unnecessary Privileges 844 599
HasMember 319 Cleartext Transmission of Sensitive Information 844 779
HasMember 400 Uncontrolled Resource Consumption 844 964
HasMember 499 Serializable Class Containing Sensitive Data 844 1198
HasMember 502 Deserialization of Untrusted Data 844 1204
HasMember 589 Call to Non-ubiquitous API 844 1325
HasMember 770 Allocation of Resources Without Limits or Throttling 844 1613
References
[REF-813]Fred Long, Dhruv Mohindra, Robert C. Seacord, Dean F. Sutherland and David
Svoboda. "The CERT Oracle Coding Standard for Java". 1st Edition. 2011 September 8. Addison-
Wesley Professional.
Category-859: The CERT Oracle Secure Coding Standard for Java (2011)
Chapter 16 - Platform Security (SEC)
Category ID : 859
Summary
Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The
CERT Oracle Secure Coding Standard for Java (2011).
Membership
Nature Type ID Name Page
MemberOf 844 Weaknesses Addressed by The CERT Oracle Secure
Coding Standard for Java (2011)
844 2564
HasMember 111 Direct Use of Unsafe JNI 844 266
HasMember 266 Incorrect Privilege Assignment 844 638
HasMember 272 Least Privilege Violation 844 656
HasMember 300 Channel Accessible by Non-Endpoint 844 730
HasMember 302 Authentication Bypass by Assumed-Immutable Data 844 735
HasMember 319 Cleartext Transmission of Sensitive Information 844 779
HasMember 347 Improper Verification of Cryptographic Signature 844 857
HasMember 470 Use of Externally-Controlled Input to Select Classes or
Code ('Unsafe Reflection')
844 1118
HasMember 494 Download of Code Without Integrity Check 844 1185
HasMember 732 Incorrect Permission Assignment for Critical Resource 844 1551
HasMember 807 Reliance on Untrusted Inputs in a Security Decision 844 1714
References
[REF-813]Fred Long, Dhruv Mohindra, Robert C. Seacord, Dean F. Sutherland and David
Svoboda. "The CERT Oracle Coding Standard for Java". 1st Edition. 2011 September 8. Addison-
Wesley Professional.
CWE Version 4.14
CWE-860: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 17 - Runtime
Environment (ENV)
CWE-860: The CERT Oracle Secure Coding Standard for
Java (2011) Chapter 17 - Runtime Environment (ENV) 2370
Category-860: The CERT Oracle Secure Coding Standard for Java (2011)
Chapter 17 - Runtime Environment (ENV)
Category ID : 860
Summary
Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The
CERT Oracle Secure Coding Standard for Java (2011).
Membership
Nature Type ID Name Page
MemberOf 844 Weaknesses Addressed by The CERT Oracle Secure
Coding Standard for Java (2011)
844 2564
HasMember 349 Acceptance of Extraneous Untrusted Data With Trusted
Data
844 861
HasMember 732 Incorrect Permission Assignment for Critical Resource 844 1551
References
[REF-813]Fred Long, Dhruv Mohindra, Robert C. Seacord, Dean F. Sutherland and David
Svoboda. "The CERT Oracle Coding Standard for Java". 1st Edition. 2011 September 8. Addison-
Wesley Professional.
Category-861: The CERT Oracle Secure Coding Standard for Java (2011)
Chapter 18 - Miscellaneous (MSC)
Category ID : 861
Summary
Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT
Oracle Secure Coding Standard for Java (2011).
Membership
Nature Type ID Name Page
MemberOf 844 Weaknesses Addressed by The CERT Oracle Secure
Coding Standard for Java (2011)
844 2564
HasMember 259 Use of Hard-coded Password 844 623
HasMember 311 Missing Encryption of Sensitive Data 844 757
HasMember 330 Use of Insufficiently Random Values 844 814
HasMember 332 Insufficient Entropy in PRNG 844 823
HasMember 333 Improper Handling of Insufficient Entropy in TRNG 844 825
HasMember 336 Same Seed in Pseudo-Random Number Generator
(PRNG)
844 832
HasMember 337 Predictable Seed in Pseudo-Random Number
Generator (PRNG)
844 834
HasMember 400 Uncontrolled Resource Consumption 844 964
HasMember 401 Missing Release of Memory after Effective Lifetime 844 973
HasMember 543 Use of Singleton Pattern Without Synchronization in a
Multithreaded Context
844 1255
HasMember 770 Allocation of Resources Without Limits or Throttling 844 1613
HasMember 798 Use of Hard-coded Credentials 844 1690
References
CWE Version 4.14
CWE-864: 2011 Top 25 - Insecure Interaction Between Components
CWE-864: 2011 Top 25 - Insecure Interaction Between Components