1854
Reference Description
CVE-2014-2503 Injection using Documentum Query Language (DQL)
https://www.cve.org/CVERecord?id=CVE-2014-2503
CVE-2014-2508 Injection using Documentum Query Language (DQL)
https://www.cve.org/CVERecord?id=CVE-2014-2508
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1027 OWASP Top Ten 2017 Category A1 - Injection 1026 2435
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Relationship
It could be argued that data query languages are effectively a command language - albeit with
a limited set of commands - and thus any query-language injection issue could be treated as
a child of CWE-74. However, CWE-943 is intended to better organize query-oriented issues to
separate them from fully-functioning programming languages, and also to provide a more precise
identifier for the many query languages that do not have their own CWE identifier.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
676 NoSQL Injection
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
Weakness ID : 1004
Structure : Simple
Abstraction : Variant
Description
The product uses a cookie to store sensitive information, but the cookie is not marked with the
HttpOnly flag.
Extended Description
The HttpOnly flag directs compatible browsers to prevent client-side script from accessing cookies.
Including the HttpOnly flag in the Set-Cookie HTTP response header helps mitigate the risk
associated with Cross-Site Scripting (XSS) where an attacker's script code might attempt to read
the contents of a cookie and exfiltrate information obtained. When set, browsers that support the
flag will not reveal the contents of the cookie to a third party via client-side script executed via XSS.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 732 Incorrect Permission Assignment for Critical Resource 1551
Applicable Platforms
CWE Version 4.14
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag