2413
Nature Type ID Name Page
HasMember 362 Concurrent Execution using Shared Resource with
Improper Synchronization ('Race Condition')
888 888
HasMember 363 Race Condition Enabling Link Following 888 897
HasMember 367 Time-of-check Time-of-use (TOCTOU) Race Condition 888 906
HasMember 370 Missing Check for Certificate Revocation after Initial
Check
888 917
HasMember 638 Not Using Complete Mediation 888 1404
Category-989: SFP Secondary Cluster: Unrestricted Lock
Category ID : 989
Summary
This category identifies Software Fault Patterns (SFPs) within the Unrestricted Lock cluster
(SFP22).
Membership
Nature Type ID Name Page
MemberOf 894 SFP Primary Cluster: Synchronization 888 2384
HasMember 412 Unrestricted Externally Accessible Lock 888 1000
Category-990: SFP Secondary Cluster: Tainted Input to Command
Category ID : 990
Summary
This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command
cluster (SFP24).
Membership
Nature Type ID Name Page
MemberOf 896 SFP Primary Cluster: Tainted Input 888 2385
HasMember 74 Improper Neutralization of Special Elements in Output
Used by a Downstream Component ('Injection')
888 137
HasMember 75 Failure to Sanitize Special Elements into a Different
Plane (Special Element Injection)
888 142
HasMember 76 Improper Neutralization of Equivalent Special Elements 888 144
HasMember 77 Improper Neutralization of Special Elements used in a
Command ('Command Injection')
888 145
HasMember 78 Improper Neutralization of Special Elements used in an
OS Command ('OS Command Injection')
888 151
HasMember 79 Improper Neutralization of Input During Web Page
Generation ('Cross-site Scripting')
888 163
HasMember 80 Improper Neutralization of Script-Related HTML Tags in
a Web Page (Basic XSS)
888 177
HasMember 81 Improper Neutralization of Script in an Error Message
Web Page
888 179
HasMember 82 Improper Neutralization of Script in Attributes of IMG
Tags in a Web Page
888 182
CWE Version 4.14
CWE-990: SFP Secondary Cluster: Tainted Input to Command
CWE-990: SFP Secondary Cluster: Tainted Input to Command