2315
Nature Type ID Name Page
MemberOf 700 Seven Pernicious Kingdoms 700 2557
HasMember 256 Plaintext Storage of a Password 700 615
HasMember 258 Empty Password in Configuration File 700 621
HasMember 259 Use of Hard-coded Password 700 623
HasMember 260 Password in Configuration File 700 629
HasMember 261 Weak Encoding for Password 700 631
HasMember 272 Least Privilege Violation 700 656
HasMember 284 Improper Access Control 700 680
HasMember 285 Improper Authorization 700 684
HasMember 330 Use of Insufficiently Random Values 700 814
HasMember 359 Exposure of Private Personal Information to an
Unauthorized Actor
700 882
HasMember 798 Use of Hard-coded Credentials 700 1690
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Security Features
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
Category-255: Credentials Management Errors
Category ID : 255
Summary
Weaknesses in this category are related to the management of credentials.
Membership
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
MemberOf 699 Software Development 699 2555
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
HasMember 256 Plaintext Storage of a Password 699 615
HasMember 257 Storing Passwords in a Recoverable Format 699 618
HasMember 260 Password in Configuration File 699 629
HasMember 261 Weak Encoding for Password 699 631
HasMember 262 Not Using Password Aging 699 633
HasMember 263 Password Aging with Long Expiration 699 636
HasMember 324 Use of a Key Past its Expiration Date 699 792
HasMember 521 Weak Password Requirements 699 1223
HasMember 523 Unprotected Transport of Credentials 699 1230
HasMember 549 Missing Password Field Masking 699 1262
CWE Version 4.14
CWE-264: Permissions, Privileges, and Access Controls
CWE-264: Permissions, Privileges, and Access Controls