별첨2) 104개 애플리케이션 취약점
카테고리
문제유형
Range and
1.
Buffer overflow
17. Failure to account for default case in
Type Errors
2.
“Write-what-where” condition
3.
Stack overflow
18. Null-pointer dereference
4.
Heap overflow
19. Using freed memory
5.
Buffer underwrite
20. Doubly freeing memory
6.
Wrap-around error
21. Invoking untrusted mobile code
7.
Integer overflow
22. Cross-site scripting
8.
Integer coercion error
23. Format string problem
9.
Truncation error
switch
(문자열의 Format이 잘못됬을때)
10. Sign extension error
24. Injection
problem(“data”
used
as
11. Signed to unsigned conversion error
something else)
12. Unsigned to signed conversion error
25. Command Injection
13. Unchecked array indexing
26. Log Injection
14. Miscalculated null termination
27. Reflection Injection
15. Improper string length checking
28. SQL Injection
16. Convert storage channer
29. Deserialization of untrusted data
Environmental
30. Reliance on data layout
37. Resource exhaustion (file descriptor,
Problem
31. Relative path library search
disk space, sockets, …)
32. Relying on package-level scope
38. Information leak through class cloning
33. Insufficient entropy in PRNG
39. Information leak through serialization
34. Failure of TRNG
40. Overflow of static internal buffer
35. Publicizing of private data when using
inner classes
36. Trust of system event data
Synchronization
41. State synchronization error
& Timing Errors
42. Covert timing channel
51. Passing
object
44. Time of check, time of use race condition
45. Comparing classes by name
55. Accidental
48. Unsafe function call from a signal handler
privileges
leaking
of
sensitive
leaking
of
sensitive
information through sent data
47. Race condition in signal handler
when
reasonable
50. Race condition in checking for certificate
revocation
an
information through error message
54. Accidental
46. Race condition in switch
drop
to
52. Mutable object returned
53. Accidental
to
objects
untrusted method
43. Symbolic name not mapping to correct
49. Failure
mutable
leaking
of
sensitive
information through data queries
56. Race condition within a thread
57. Reflection attak in an auto protocol
58. Capture-replay
카테고리
Protocol Errors
문제유형
59. Failure
to
follow
chain
of
trust
in
certificate validation
60. Key
72. Using referrer field for authentication
73. Using a broken or risky cryptographic
exchange
without
entity
authentication
algorithm
74. Using password systems
61. Failure to validate host-specific certificate
data
75. Using single-factor authentication
76. Not allowing password aging
62. Failure to validate certificate expiration
77. Allowing password aging
63. Failure to check for certificate revocation
78. Reusing
64. Failure to encrypt data
a
nonce,
key
pair
in
encryption
65. Failure to add integrity check value
79. Using a key past its expiration date
66. Failure to check integrity check value
80. Not using a random IV with CBC
67. Use of hard-coded password
mode
68. Use of hard-coded cryptographic key
69. Storing
passwords
in
a
recoverable
format
70. Trusting self-reported IP address
81. Failure to protect stored data from
modification
82. Failure to provide confidentiality for
stored data
71. Trusting self-reported DNS name
Generic
83. Ignore function return value
96. Omitted break statement
Logic Errors
84. Missing parameter
97. Improper
85. Misinterpreted function return value
cleanup
on
thrown
exception
86. Uninitialized variable
98. Uncaught exception
87. Duplicate key in associative list (alist)
99. Improper error handling
88. Deletion of data-structure sentinel
100.
Improper temp file opening
89. Addition of data-structure sentinel
101.
Guessed or visible temporary file
90. Use of sizeof() on a pointer type
102.
Failure to deallocate data
91. Unintentional pointer scaling
103.
Non-cryptographic PRNG
92. Improper pointer subtraction
104.
Failure
93. Assigning instead of comparing
94. Comparing instead of assigning
95. Incorrect block delimitation
to
check
whether
privileges were dropped successfully