2371
[REF-813]Fred Long, Dhruv Mohindra, Robert C. Seacord, Dean F. Sutherland and David
Svoboda. "The CERT Oracle Coding Standard for Java". 1st Edition. 2011 September 8. Addison-
Wesley Professional.
Category-864: 2011 Top 25 - Insecure Interaction Between Components
Category ID : 864
Summary
Weaknesses in this category are listed in the "Insecure Interaction Between Components" section
of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
Membership
Nature Type ID Name Page
MemberOf 900 Weaknesses in the 2011 CWE/SANS Top 25 Most
Dangerous Software Errors
900 2572
HasMember 78 Improper Neutralization of Special Elements used in an
OS Command ('OS Command Injection')
900 151
HasMember 79 Improper Neutralization of Input During Web Page
Generation ('Cross-site Scripting')
900 163
HasMember 89 Improper Neutralization of Special Elements used in an
SQL Command ('SQL Injection')
900 201
HasMember 352 Cross-Site Request Forgery (CSRF) 900 868
HasMember 434 Unrestricted Upload of File with Dangerous Type 900 1048
HasMember 601 URL Redirection to Untrusted Site ('Open Redirect') 900 1345
HasMember 829 Inclusion of Functionality from Untrusted Control Sphere 900 1741
References
[REF-843]"2011 CWE/SANS Top 25 Most Dangerous Software Errors". 2011 June 7. < http://
cwe.mitre.org/top25/archive/2011/2011_cwe_sans_top25.html >.
Category-865: 2011 Top 25 - Risky Resource Management
Category ID : 865
Summary
Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011
CWE/SANS Top 25 Most Dangerous Software Errors.
Membership
Nature Type ID Name Page
MemberOf 900 Weaknesses in the 2011 CWE/SANS Top 25 Most
Dangerous Software Errors
900 2572
HasMember 22 Improper Limitation of a Pathname to a Restricted
Directory ('Path Traversal')
900 33
HasMember 120 Buffer Copy without Checking Size of Input ('Classic
Buffer Overflow')
900 304
HasMember 131 Incorrect Calculation of Buffer Size 900 355
HasMember 134 Use of Externally-Controlled Format String 900 365
HasMember 190 Integer Overflow or Wraparound 900 472
HasMember 494 Download of Code Without Integrity Check 900 1185
CWE Version 4.14
CWE-866: 2011 Top 25 - Porous Defenses
CWE-866: 2011 Top 25 - Porous Defenses