MIND|DROPS » Programming Errors http://www.mindrops.org Our thoughts define our personal reality Tue, 01 Jun 2010 13:14:19 +0000 http://wordpress.org/?v=2.9.2 it hourly 1 Top 25 most dangerous programming errors http://www.mindrops.org/2010/02/27/top-25-most-dangerous-programming-errors/ http://www.mindrops.org/2010/02/27/top-25-most-dangerous-programming-errors/#comments Sat, 27 Feb 2010 00:57:40 +0000 MzC http://www.mindrops.org/?p=3723 Sul sito ufficiale della Common Weakness Enumeration (CWE) e’ possibile consultare liberamente un community-developed dictionary di software weakness types. A seguire la lista aggiornata al 2010 dei 25 errori di programmazione ritenuti piu’ “pericolosi”, un utile riferimento per qualunque sviluppatore.

The 2010 CWE/SANS Top 25 Most Dangerous Programming Errors is a list of the most widespread and critical programming errors that can lead to serious software vulnerabilities. They are often easy to find, and easy to exploit. They are dangerous because they will frequently allow attackers to completely take over the software, steal data, or prevent the software from working at all [...]

Rank Score ID Name
[1] 346 CWE-79 Failure to Preserve Web Page Structure (‘Cross-site Scripting’)
[2] 330 CWE-89 Improper Sanitization of Special Elements used in an SQL Command (‘SQL Injection’)
[3] 273 CWE-120 Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
[4] 261 CWE-352 Cross-Site Request Forgery (CSRF)
[5] 219 CWE-285 Improper Access Control (Authorization)
[6] 202 CWE-807 Reliance on Untrusted Inputs in a Security Decision
[7] 197 CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
[8] 194 CWE-434 Unrestricted Upload of File with Dangerous Type
[9] 188 CWE-78 Improper Sanitization of Special Elements used in an OS Command (‘OS Command Injection’)
[10] 188 CWE-311 Missing Encryption of Sensitive Data
[11] 176 CWE-798 Use of Hard-coded Credentials
[12] 158 CWE-805 Buffer Access with Incorrect Length Value
[13] 157 CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP File Inclusion’)
[14] 156 CWE-129 Improper Validation of Array Index
[15] 155 CWE-754 Improper Check for Unusual or Exceptional Conditions
[16] 154 CWE-209 Information Exposure Through an Error Message
[17] 154 CWE-190 Integer Overflow or Wraparound
[18] 153 CWE-131 Incorrect Calculation of Buffer Size
[19] 147 CWE-306 Missing Authentication for Critical Function
[20] 146 CWE-494 Download of Code Without Integrity Check
[21] 145 CWE-732 Incorrect Permission Assignment for Critical Resource
[22] 145 CWE-770 Allocation of Resources Without Limits or Throttling
[23] 142 CWE-601 URL Redirection to Untrusted Site (‘Open Redirect’)
[24] 141 CWE-327 Use of a Broken or Risky Cryptographic Algorithm
[25] 138 CWE-362 Race Condition
]]> http://www.mindrops.org/2010/02/27/top-25-most-dangerous-programming-errors/feed/lang/it/ 0