Thursday, March 28, 2024

CWE Top 25 – Mitre Released Top 25 Most Dangerous Software Bugs

Recently, Mitre released the top 25 most dangerous software bugs 2020; this list is a definitive list of the most popular and impactful issues that are encountered in CWE Top 25 (2019).

The security experts asserted that these software bugs are dangerous, as they are usually easy to find and exploit. Moreover, it enables attackers to hijack a system completely, steals data, or stop an application from working.

The CWE top 25 is a worthwhile association resource that will help the developers, researchers, as well as the users to secure their businesses. Moreover, CWE provides penetration into the most severe and modern security vulnerabilities.

25 Most Dangerous Software Bugs

RankIDNameScore
[1]CWE-79Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)46.82
[2]CWE-787Out-of-bounds Write46.17
[3]CWE-20Improper Input Validation33.47
[4]CWE-125Out-of-bounds Read26.50
[5]CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer23.73
[6]CWE-89Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)20.69
[7]CWE-200Exposure of Sensitive Information to an Unauthorized Actor19.16
[8]CWE-416Use After Free18.87
[9]CWE-352Cross-Site Request Forgery (CSRF)17.29
[10]CWE-78Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)16.44
[11]CWE-190Integer Overflow or Wraparound15.81
[12]CWE-22Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)13.67
[13]CWE-476NULL Pointer Dereference8.35
[14]CWE-287Improper Authentication8.17
[15]CWE-434Unrestricted Upload of File with Dangerous Type7.38
[16]CWE-732Incorrect Permission Assignment for Critical Resource6.95
[17]CWE-94Improper Control of Generation of Code (‘Code Injection’)6.53
[18]CWE-522Insufficiently Protected Credentials5.49
[19]CWE-611Improper Restriction of XML External Entity Reference5.33
[20]CWE-798Use of Hard-coded Credentials5.19
[21]CWE-502Deserialization of Untrusted Data4.93
[22]CWE-269Improper Privilege Management4.87
[23]CWE-400Uncontrolled Resource Consumption4.14
[24]CWE-306Missing Authentication for Critical Function3.85
[25]CWE-862Missing Authorization3.77

Analysis Report

This year’s Top 25 CWE list has increased the transition to more distinct weaknesses as they are fought to complex class-level vulnerabilities. These class-level weaknesses yet endure in the list, but these weaknesses have moved down in the ranking. 

The security researchers affirmed that this movement would be continuing, as every year, more advanced and dangerous weaknesses will be introduced. 

If we look correctly to list, then we can recognize that the class-level weaknesses like the CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), the CWE-20 (Improper Input Validation), and the CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) all have moved down a few of places. 

On the other side, there are more specific weaknesses like the CWE-79 (Improper Neutralization of Input During Web Page Generation), and the CWE-787 (Out-of-bounds Write), and CWE-125 (Out-of-bounds Read) were moved towards up to take their spots.

Rather than this weakness, there is another specific movement that is again the result of the mapping, the CWE-772 (Missing Release of Resource after Effective Lifetime) was at the number 21 in the list. And as we said that this movement would be continuing, as every year, new specific weaknesses will be introduced.

Flaws related to Authentication and Authorization

The most significant progress of the list comprises four major weaknesses that are associated with the Authentication and Authorization, and here they are mentioned below:-

  • The CWE-522 (Insufficiently Protected Credentials): from 27 to 18
  • The CWE-306 (Missing Authentication for Critical Function): from 36 to 24
  • The CWE-862 (Missing Authorization): from 34 to 25
  • CWE-863 (Incorrect Authorization): from 33 to 29

Methodology

This new list is quite specific, as it was developed by getting all issued vulnerability data from the NVD. The NVD gets these vulnerability data from CVE and then extends these vulnerabilities along with the additional analysis and information.

This information includes a mapping to one or more weaknesses, and at the same time, the CVSS score, which is a numerical score outlining the possible severity of all these vulnerabilities that are generally based upon a regulated set of features regarding the vulnerability.

Moreover, this year’s list is more leverage as compared to the list of 2018 and 2019. However, to ascertain a CWE’s frequency, the scoring formula determines the number of occasions a CWE is mapped to a CVE with the NVD.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles