attack-surface-reduction-strategy

CWE VIEW:Attack Surface Reduction Strategy

ID:BOSS-286

Vulnerability Mapping:Prohibited

Type:Implicit

Status:Draft

Details Content History Observed CVE Examples Reports

▼Objective

This view (slice) displays Attack Surface Reduction strategy weaknesses.

▼Memberships

Nature	Mapping	Type	ID	Name
HasMember	Discouraged	C	20	Improper Input Validation
HasMember	Allowed	B	209	Generation of Error Message Containing Sensitive Information
HasMember	Allowed	B	212	Improper Removal of Sensitive Information Before Storage or Transfer
HasMember	Allowed	B	22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
HasMember	Allowed	B	250	Execution with Unnecessary Privileges
HasMember	Discouraged	C	311	Missing Encryption of Sensitive Data
HasMember	Allowed	V	416	Use After Free
HasMember	Allowed-with-Review	B	426	Untrusted Search Path
HasMember	Allowed-with-Review	B	427	Uncontrolled Search Path Element
HasMember	Allowed	V	457	Use of Uninitialized Variable
HasMember	Allowed	B	601	URL Redirection to Untrusted Site ('Open Redirect')
HasMember	Allowed-with-Review	C	642	External Control of Critical State Data
HasMember	Allowed	B	749	Exposed Dangerous Method or Function
HasMember	Allowed	B	78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
HasMember	Allowed	B	79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
HasMember	Allowed	V	80	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
HasMember	Allowed	B	807	Reliance on Untrusted Inputs in a Security Decision
HasMember	Allowed	V	81	Improper Neutralization of Script in an Error Message Web Page
HasMember	Allowed	V	82	Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
HasMember	Allowed	B	829	Inclusion of Functionality from Untrusted Control Sphere
HasMember	Allowed	V	83	Improper Neutralization of Script in Attributes in a Web Page
HasMember	Allowed	V	84	Improper Neutralization of Encoded URI Schemes in a Web Page
HasMember	Allowed	V	85	Doubled Character XSS Manipulations
HasMember	Allowed	V	86	Improper Neutralization of Invalid Characters in Identifiers in Web Pages
HasMember	Allowed	V	87	Improper Neutralization of Alternate XSS Syntax
HasMember	Allowed	V	926	Improper Export of Android Application Components
HasMember	Allowed	V	942	Permissive Cross-domain Policy with Untrusted Domains
HasMember	Allowed	V	98	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Nature: HasMember

Mapping: Discouraged

Type: Class

ID: 20

Name: Improper Input Validation

Nature: HasMember

Mapping: Allowed

Type: Base

ID: 209

Name: Generation of Error Message Containing Sensitive Information

Nature: HasMember

Mapping: Allowed

Type: Base

ID: 212

Name: Improper Removal of Sensitive Information Before Storage or Transfer

Nature: HasMember

Mapping: Allowed

Type: Base

ID: 22

Name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Nature: HasMember

Mapping: Allowed

Type: Base

ID: 250

Name: Execution with Unnecessary Privileges

Nature: HasMember

Mapping: Discouraged

Type: Class

ID: 311

Name: Missing Encryption of Sensitive Data

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 416

Name: Use After Free

Nature: HasMember

Mapping: Allowed-with-Review

Type: Base

ID: 426

Name: Untrusted Search Path

Nature: HasMember

Mapping: Allowed-with-Review

Type: Base

ID: 427

Name: Uncontrolled Search Path Element

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 457

Name: Use of Uninitialized Variable

Nature: HasMember

Mapping: Allowed

Type: Base

ID: 601

Name: URL Redirection to Untrusted Site ('Open Redirect')

Nature: HasMember

Mapping: Allowed-with-Review

Type: Class

ID: 642

Name: External Control of Critical State Data

Nature: HasMember

Mapping: Allowed

Type: Base

ID: 749

Name: Exposed Dangerous Method or Function

Nature: HasMember

Mapping: Allowed

Type: Base

ID: 78

Name: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Nature: HasMember

Mapping: Allowed

Type: Base

ID: 79

Name: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 80

Name: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Nature: HasMember

Mapping: Allowed

Type: Base

ID: 807

Name: Reliance on Untrusted Inputs in a Security Decision

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 81

Name: Improper Neutralization of Script in an Error Message Web Page

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 82

Name: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Nature: HasMember

Mapping: Allowed

Type: Base

ID: 829

Name: Inclusion of Functionality from Untrusted Control Sphere

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 83

Name: Improper Neutralization of Script in Attributes in a Web Page

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 84

Name: Improper Neutralization of Encoded URI Schemes in a Web Page

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 85

Name: Doubled Character XSS Manipulations

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 86

Name: Improper Neutralization of Invalid Characters in Identifiers in Web Pages

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 87

Name: Improper Neutralization of Alternate XSS Syntax

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 926

Name: Improper Export of Android Application Components

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 942

Name: Permissive Cross-domain Policy with Untrusted Domains

Nature: HasMember

Mapping: Allowed

Type: Variant

ID: 98

Name: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

▼Vulnerability Mapping Notes

Usage:Prohibited

Reason:View

Rationale:

This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.

Comments:

Use this View or other Views to search and navigate for the appropriate weakness.