DATASHEET
CWE C and C++ Rule Enforcement (2022)
ENFORCEMENT HELIX QAC 2023.4
CWE enforcement is measured against defined lists of weaknesses which do not all apply to every language.
2022 CWE Top 25 Most Dangerous Software Weaknesses
https://cwe.mitre.org/top25/archive/2022/2022_cwe_top25.html
Rank | CWE ID | Description | Enforced C | Enforced C++ |
|---|---|---|---|---|
[1] | Out-of-bounds Write | Yes | Yes | |
[2] | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | N/A | N/A | |
[3] | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | No | No | |
[4] | Improper Input Validation | Yes | Yes | |
[5] | Out-of-bounds Read | Yes | Yes | |
[6] | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) | Yes | Yes | |
[7] | Use After Free | Yes | Yes | |
[8] | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | No | No | |
[9] | Cross-Site Request Forgery (CSRF) | N/A | N/A | |
[10] | Unrestricted Upload of File with Dangerous Type | N/A | N/A | |
[11] | NULL Pointer Dereference | Yes | Yes | |
[12] | Deserialization of Untrusted Data | N/A | N/A | |
[13] | Integer Overflow or Wraparound | Yes | Yes | |
[14] | Improper Authentication | N/A | N/A | |
[15] | Use of Hard-coded Credentials | No | No | |
[16] | Missing Authorization | No | No | |
[17] | Improper Neutralization of Special Elements used in a Command (‘Command Injection’) | No | No | |
[18] | Missing Authentication for Critical Function | No | No | |
[19] | Improper Restriction of Operations within the Bounds of a Memory Buffer | Yes | Yes | |
[20] | Incorrect Default Permissions | N/A | N/A | |
[21] | Server-Side Request Forgery (SSRF) | N/A | N/A | |
[22] | Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) | Yes | Yes | |
[23] | Uncontrolled Resource Consumption | No | No | |
[24] | Improper Restriction of XML External Entity Reference | N/A | N/A | |
[25] | Improper Control of Generation of Code (‘Code Injection’) | N/A | N/A |