"Enter"a basıp içeriğe geçin

2020 CWE Top 25 Most Dangerous Software Weaknesses

RankIDNameScore
[1]CWE-79Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)46.82
[2]CWE-787Out-of-bounds Write46.17
[3]CWE-20Improper Input Validation33.47
[4]CWE-125Out-of-bounds Read26.50
[5]CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer23.73
[6]CWE-89Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)20.69
[7]CWE-200Exposure of Sensitive Information to an Unauthorized Actor19.16
[8]CWE-416Use After Free18.87
[9]CWE-352Cross-Site Request Forgery (CSRF)17.29
[10]CWE-78Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)16.44
[11]CWE-190Integer Overflow or Wraparound15.81
[12]CWE-22Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)13.67
[13]CWE-476NULL Pointer Dereference8.35
[14]CWE-287Improper Authentication8.17
[15]CWE-434Unrestricted Upload of File with Dangerous Type7.38
[16]CWE-732Incorrect Permission Assignment for Critical Resource6.95
[17]CWE-94Improper Control of Generation of Code (‘Code Injection’)6.53
[18]CWE-522Insufficiently Protected Credentials5.49
[19]CWE-611Improper Restriction of XML External Entity Reference5.33
[20]CWE-798Use of Hard-coded Credentials5.19
[21]CWE-502Deserialization of Untrusted Data4.93
[22]CWE-269Improper Privilege Management4.87
[23]CWE-400Uncontrolled Resource Consumption4.14
[24]CWE-306Missing Authentication for Critical Function3.85
[25]CWE-862Missing Authorization3.77

https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html