TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

CWE Top Most Dangerous Software Weaknesses

155 点作者 dlor将近 2 年前

9 条评论

dlor将近 2 年前
It&#x27;s somewhat disheartening as a software developer focused on security that the top four elements are still:<p>* Out-of-bounds Write<p>* Improper Neutralization of Input During Web Page Generation (&#x27;Cross-site Scripting&#x27;)<p>* Improper Neutralization of Special Elements used in an SQL Command (&#x27;SQL Injection&#x27;)<p>* Use After Free
评论 #36707931 未加载
评论 #36707795 未加载
评论 #36707701 未加载
评论 #36708238 未加载
评论 #36708343 未加载
评论 #36707736 未加载
评论 #36708285 未加载
评论 #36707932 未加载
评论 #36708467 未加载
评论 #36722817 未加载
BoppreH将近 2 年前
Aside from Memory Management, there&#x27;s another general category that always comes up in these lists, but is not talked about much: in-band signaling (i.e., &quot;Strings are Evil&quot;):<p>- Improper Neutralization of Input During Web Page Generation (&#x27;Cross-site Scripting&#x27;) (#2)<p>- Improper Neutralization of Special Elements used in an SQL Command (&#x27;SQL Injection&#x27;) (#3)<p>- Improper Neutralization of Special Elements used in an OS Command (&#x27;OS Command Injection&#x27;) (#4)<p>- Improper Limitation of a Pathname to a Restricted Directory (&#x27;Path Traversal&#x27;) (#8)<p>- Improper Neutralization of Special Elements used in a Command (&#x27;Command Injection&#x27;) (#16)<p>- Improper Control of Generation of Code (&#x27;Code Injection&#x27;) (#23)<p><i>All</i> of these came from trying to avoid structured data, and instead using strings with &quot;special characters&quot;. It&#x27;s crazy how many times this mistake has been repeated: file paths, URLs, log files, CSV, HTML, HTTP (cookies, headers, query strings), domain names, SQL, shell commands, shell pipelines... One unescaped character, from anywhere in the stack, and it all blows up.<p>One could say &quot;at least it&#x27;s human-readable&quot;, but that&#x27;s not reliable either. Take files names, for example. Two visually identical file names may map to different files (because confusables[1] or surrounding spaces), or two different names map to the same file (because normalization[2]), or the &quot;.jpg&quot; at the end may not actually be the extension (because right-to-left override[3]).<p>So the <i>computer interpretation</i> of a string might be wrong because a special character sneaked in. And even if everyone was perfectly careful, the <i>human interpretation</i> might still be wrong. For the sake of the next generations, I hope we leave strings for human text and nothing more.<p>[1] <a href="https:&#x2F;&#x2F;unicode.org&#x2F;cldr&#x2F;utility&#x2F;confusables.jsp" rel="nofollow noreferrer">https:&#x2F;&#x2F;unicode.org&#x2F;cldr&#x2F;utility&#x2F;confusables.jsp</a><p>[2] <a href="https:&#x2F;&#x2F;developer.apple.com&#x2F;library&#x2F;archive&#x2F;qa&#x2F;qa1173&#x2F;_index.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;developer.apple.com&#x2F;library&#x2F;archive&#x2F;qa&#x2F;qa1173&#x2F;_index...</a><p>[3] <a href="https:&#x2F;&#x2F;krebsonsecurity.com&#x2F;2011&#x2F;09&#x2F;right-to-left-override-aids-email-attacks&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;krebsonsecurity.com&#x2F;2011&#x2F;09&#x2F;right-to-left-override-a...</a>
评论 #36708730 未加载
评论 #36708892 未加载
评论 #36708728 未加载
评论 #36708875 未加载
评论 #36709007 未加载
评论 #36709649 未加载
heelix将近 2 年前
Mitre really lost a lot of respect with CVE-2016-1000027. Every few weeks a warning that any SpringBoot 2.x project has a CVSS 9.8, which causes all sorts of heartache for those of us bound to CVE remediation. Every blasted security tool reports this one. Spring reviewed and rejected, as did our very, very large organization. Comically, this has become the CVE we use to see how our tools allow us to white&#x2F;black list entries.<p>Thank god Spring dropped this interface in the Framework 6.x &#x2F; Boot 3.x release, and the end for non-commercial support is this year for the old stuff.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;spring-projects&#x2F;spring-framework&#x2F;issues&#x2F;24434">https:&#x2F;&#x2F;github.com&#x2F;spring-projects&#x2F;spring-framework&#x2F;issues&#x2F;2...</a> <a href="https:&#x2F;&#x2F;github.com&#x2F;advisories&#x2F;GHSA-4wrc-f8pq-fpqp">https:&#x2F;&#x2F;github.com&#x2F;advisories&#x2F;GHSA-4wrc-f8pq-fpqp</a>
评论 #36713945 未加载
matt2000将近 2 年前
It should be considered a failure of our profession that after all these years the number 1 issue is still out of bounds write, a memory safety issue. In any true engineering profession a failure of this sort would be unacceptable, but in ours it&#x27;s tolerated and explained away as a necessary byproduct of certain tools. How much personal information has been compromised due to these low standards? How many people put at risk? It&#x27;s shameful.
评论 #36712662 未加载
评论 #36709804 未加载
pulse7将近 2 年前
Here are Language-Specific ones:<p>1. CWE-787 Out-of-bounds Write: C, C++, Assembly<p>4. CWE-416 Use After Free: C, C++<p>7. CWE-125 Out-of-bounds Read: C, C++<p>10. CWE-434 Unrestricted Upload of File with Dangerous Type: ASP.NET, PHP, Class: Not Language-Specific<p>12. CWE-476 NULL Pointer Dereference: C, C++, Java, C#, Go<p>15. CWE-502 Deserialization of Untrusted Data: Java, Ruby, PHP, Python, JavaScript<p>17. CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer: C, C++, Assembly<p>21. CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (&#x27;Race Condition&#x27;): C, C++, Java<p>23. CWE-94 Improper Control of Generation of Code (&#x27;Code Injection&#x27;): Interpreted
评论 #36708220 未加载
评论 #36708835 未加载
评论 #36708584 未加载
评论 #36708270 未加载
评论 #36708071 未加载
评论 #36708536 未加载
amelius将近 2 年前
Is anyone using Valgrind even anymore these days?<p>I&#x27;ve noticed that using Valgrind on Python systems is almost impossible because most modules have not been built with Valgrind in mind and thus you get swamped in noise.<p>I suppose the same is true for any large system that uses many different third party libraries.
评论 #36708735 未加载
评论 #36743245 未加载
评论 #36713060 未加载
评论 #36712019 未加载
gemanor将近 2 年前
I&#x27;m really waiting to see all those shift-left startup founders that will craft a new world of developer-oriented products from this list. IMHO, the real way to look at it is how we can influence developers (by choosing the suitable languages, platforms, architectures, etc.) and then measure them after they find the vulns.<p>From the optimistic side, it looks like the safest language to write an app today with is TypeScript.
评论 #36712415 未加载
timewasterthrow将近 2 年前
Wordle sold for a $1M+ and put all the solutions for the future games into the javascript file. Security is important, but its a spectrum.
badrabbit将近 2 年前
CSRF higher than improper auth? Yeah...don&#x27;t think so.