Skip to main content

Questions tagged [cwe]

For CWE, Common Weakness Enumeration. Not to be confused with CVE.

Filter by
Sorted by
Tagged with
0 votes
1 answer
154 views

CWE for "Misconfigured server allows insecure https request to IP-addressed URL"?

I'm doing a vulnerability assessment for a whole slew of web servers, and almost every single one of them (hundreds) are misconfigured like the following two examples: Case 1: one or more hostnames ...
Bitbang3r's user avatar
  • 331
1 vote
0 answers
119 views

CWEs for Language Machine Learning Models

I'm looking for the relevant CWE's for specific attacks against prompt-based language ML models, such as GPT-3, GPT-4 etc. Specifically: Prompt Injection: Amending prompts with malicious input to ...
Vjz's user avatar
  • 11
6 votes
3 answers
2k views

Why are there multiple "Hardcoded Password" Entries in CWE instead of single one?

When I looked up hardcoded password vulnerability in software world, I saw there are three kinds of vulnerabilities. These are that: CWE-798: Use of Hard-coded Credentials The Hardcoded Creds ...
Hasan's user avatar
  • 519
0 votes
2 answers
145 views

What types of software can have "Hardcoded Password" vulnerability?

When I investigated the Google results, the software vulnerability "Hardcoded Password" (cwe-798 & cwe-259) is a vulnerability for IoT devices' software (see: link1) and thick client ...
Hasan's user avatar
  • 519
0 votes
2 answers
3k views

How can I map CVEs to their underlying CWE?

I was tasked with developing a consistent, relatively complete map for CVEs to CWEs at my internship, and I'm kind of at a loss finding a method to find a 1-to-1 way to map CVEs onto CWEs. Ideally, ...
Derek Lynch's user avatar
1 vote
0 answers
258 views

CWE-611: Improper Restriction of XML External Entity Reference with XSL include

Veracode reports that the below code is susceptible to CWE-611: Improper Restriction of XML External Entity Reference. XslCompiledTransform transform = new XslCompiledTransform(); transform.Load(...
Hoppe's user avatar
  • 143
3 votes
1 answer
212 views

Faults vs weaknesses

I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration). The word "fault" is generally used in the reliability domain, to designate the cause ...
Ecterion's user avatar
  • 103
0 votes
1 answer
347 views

CWE-234 - Snprintf Missing Parameter issues

We are scanning a third party library using a well know static analysis tool here. We keep getting: "Failure to Handle Missing Parameter CWE ID 234" I'm not a C developer but I can't see what is ...
Smitch's user avatar
  • 3
4 votes
1 answer
1k views

How to find CAPEC items related to a CVE

Vulnerabilities with a CVE usually also have a CWE associated with them, but almost never CAPEC. CWE's site also only very rarely points to related CAPEC items. Is there a way to find a CVE's ...
drdrek's user avatar
  • 175
5 votes
1 answer
254 views

Categorizing a data leak which is intentionally / by carelessness / by design

I have found a publicly accessible web page which discloses person-related data when queried with matching input data. This is against the company's own data protection promise. I want to report ...
Marcel's user avatar
  • 4,093