2428
Nature Type ID Name Page
MemberOf 1008 Architectural Concepts 1008 2577
HasMember 208 Observable Timing Discrepancy 1008 529
HasMember 392 Missing Report of Error Condition 1008 951
HasMember 460 Improper Cleanup on Thrown Exception 1008 1102
HasMember 544 Missing Standardized Error Handling Mechanism 1008 1256
HasMember 602 Client-Side Enforcement of Server-Side Security 1008 1350
HasMember 703 Improper Check or Handling of Exceptional Conditions 1008 1535
HasMember 754 Improper Check for Unusual or Exceptional Conditions 1008 1568
HasMember 784 Reliance on Cookies without Validation and Integrity
Checking in a Security Decision
1008 1653
HasMember 807 Reliance on Untrusted Inputs in a Security Decision 1008 1714
References
[REF-9]Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture
Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <
https://design.se.rit.edu/papers/cawe-paper.pdf >.
[REF-10]Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding
Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of
Chromium, PHP and Thunderbird.". 2017 IEEE International Conference on Software Architecture
(ICSA). 2017. < https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf >.
Category-1013: Encrypt Data
Category ID : 1013
Summary
Weaknesses in this category are related to the design and architecture of data confidentiality in a
system. Frequently these deal with the use of encryption libraries. The weaknesses in this category
could lead to a degradation of the quality data encryption if they are not addressed when designing
or implementing a secure architecture.
Membership
Nature Type ID Name Page
MemberOf 1008 Architectural Concepts 1008 2577
HasMember 256 Plaintext Storage of a Password 1008 615
HasMember 257 Storing Passwords in a Recoverable Format 1008 618
HasMember 260 Password in Configuration File 1008 629
HasMember 261 Weak Encoding for Password 1008 631
HasMember 311 Missing Encryption of Sensitive Data 1008 757
HasMember 312 Cleartext Storage of Sensitive Information 1008 764
HasMember 313 Cleartext Storage in a File or on Disk 1008 770
HasMember 314 Cleartext Storage in the Registry 1008 772
HasMember 315 Cleartext Storage of Sensitive Information in a Cookie 1008 774
HasMember 316 Cleartext Storage of Sensitive Information in Memory 1008 775
HasMember 317 Cleartext Storage of Sensitive Information in GUI 1008 777
HasMember 318 Cleartext Storage of Sensitive Information in Executable 1008 778
HasMember 319 Cleartext Transmission of Sensitive Information 1008 779
HasMember 321 Use of Hard-coded Cryptographic Key 1008 785
HasMember 323 Reusing a Nonce, Key Pair in Encryption 1008 790
CWE Version 4.14
CWE-1014: Identify Actors
CWE-1014: Identify Actors