32
CAPEC-ID Attack Pattern Name
43 Exploiting Multiple Input Interpretation Layers
45 Buffer Overflow via Symbolic Links
46 Overflow Variables and Tags
47 Buffer Overflow via Parameter Expansion
52 Embedding NULL Bytes
53 Postfix, Null Terminate, and Backslash
63 Cross-Site Scripting (XSS)
64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
67 String Format Overflow in syslog()
71 Using Unicode Encoding to Bypass Validation Logic
72 URL Encoding
73 User-Controlled Filename
78 Using Escaped Slashes in Alternate Encoding
79 Using Slashes in Alternate Encoding
80 Using UTF-8 Encoding to Bypass Validation Logic
81 Web Server Logs Tampering
83 XPath Injection
85 AJAX Footprinting
88 OS Command Injection
101 Server Side Include (SSI) Injection
104 Cross Zone Scripting
108 Command Line Execution through SQL Injection
109 Object Relational Mapping Injection
110 SQL Injection through SOAP Parameter Tampering
120 Double Encoding
135 Format String Injection
136 LDAP Injection
153 Input Data Manipulation
182 Flash Injection
209 XSS Using MIME Type Mismatch
230 Serialized Data with Nested Payloads
231 Oversized Serialized Data Payloads
250 XML Injection
261 Fuzzing for garnering other adjacent user/sensitive data
267 Leverage Alternate Encoding
473 Signature Spoof
588 DOM-Based XSS
664 Server Side Request Forgery
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-166]Jim Manico. "Input Validation with ESAPI - Very Important". 2008 August 5. < https://
manicode.blogspot.com/2008/08/input-validation-with-esapi.html >.2023-04-07.
[REF-45]OWASP. "OWASP Enterprise Security API (ESAPI) Project". < http://www.owasp.org/
index.php/ESAPI >.
[REF-168]Joel Scambray, Mike Shema and Caleb Sima. "Hacking Exposed Web Applications,
Second Edition". 2006 June 5. McGraw-Hill.
CWE Version 4.14
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22: Improper Limitation of a Pathname
to a Restricted Directory ('Path Traversal')