I have search a lot in the internet and I didn't find anything that is directly answer my question. What type of vulnerabilities are out there. I mean vulnerabilities like buffer overrun, not like XSS or SQLi etc. Here is a short list of vulnerabilities I know that exist:

  1. Buffer overruns(stack and heap)
  2. Integer overflow
  3. Format string vulnerability
  4. Access Control Problems

Could anybody add something to this list?

closed as too broad by Philipp, TildalWave, Eric G, tylerl, Rory Alsop May 3 '14 at 17:10

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • While Gumbo's answer is excellent, this question is actually incredibly broad. Also, the second part of your question is explicitly off topic here, so I have removed it for you. – Rory Alsop May 3 '14 at 17:12

I think the most comprehensible dictionary of software weaknesses is the Common Weakness Enumeration (CWE).

The view Development Concepts (CWE-699) may be a good starting point for you:

This view organizes weaknesses around concepts that are frequently used or encountered in software development. Accordingly, this view can align closely with the perspectives of developers, educators, and assessment vendors.

There are also graphical depictions of CWE, which shows relations of weaknesses in a directed graph, e. g., the graphical depiction of CWE-699.


I think this question is too broad, but OWASP is probably the closest thing to what you're asking: https://www.owasp.org

Their "Top 10" threat list: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project#tab=OWASP_Top_10_for_2013

Their cheat sheets: https://www.owasp.org/index.php/Cheat_Sheets

Developers guide: https://www.owasp.org/index.php/Guide_Table_of_Contents

  • 1
    The question isn't broad. I'm asking only for the names of the most common vulnerabilities in the software code. OWASP is about WEB APPLICATIONS, I said that I'm not asking about XSS and SQLi etc.. – user45916 May 3 '14 at 9:35
  • OWASP covers these things: owasp.org/index.php/Buffer_Overflows search on that guide table of content page. Plus, SQLi can easily apply to traditional desktop applications. – thexacre May 3 '14 at 10:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.