ソスyソスソスソスpソスKソスCソスhソスz

CWE-20

Weakness ID:20(Weakness Class)

Status: Draft

ソスsソスKソスリな難ソスソスヘ確ソスF

ソスソスソス

ソスソスソスソスvソスソス

ソスソスソスフ脆弱性ソスソスソスソスソス髏サソスiソスヘ、ソスvソスソスソスOソスソスソスソスソスフ撰ソスソスソスtソスソスソス[ソスソスソスソスムデソス[ソス^ソスtソスソスソス[ソスヨ影ソスソスソスソスソスyソスレゑソスソスソスソスヘに対ゑソスソスAソスKソスリな妥難ソスソスソスソス`ソスFソスbソスNソスソスソスsソスソスソスワゑソスソスソスB

ソスレ細な会ソスソス

ソス\ソスtソスgソスEソスFソスAソスノゑソスソスソスソスソスソスソスヘの妥難ソスソスソスソスフ確ソスFソスソスソスsソス\ソスソスソスネ場合ソスAソスUソスソスソスメゑソスソスソスソスフアソスvソスソスソスPソス[ソスVソスソスソスソスソスフフソスHソス[ソスソスソスノ意図ソスソスソスネゑソスソスソスソスヘゑソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスBソスソスソスフ難ソスソスヘはシソスXソスeソスソスソスフ一部ソスノ受け渡ソスソスソスソスAソスソスソスソスtソスソスソス[ソスフ会ソスソスソスソスソスAソスCソスモのソスソス\ソス[ソスXソスフ撰ソスソスソスAソスCソスモのコソス[ソスhソスソスソスソスソスsソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソスニ弱性ソスフ費ソスソスソスソスソスソスソス

ソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計
ソスソスソスソス

ソスYソスソスソスソスソスソスvソスソスソスbソスgソスtソスHソス[ソスソス

ソスソスソスソス

ソスソスソスソスノ依托ソス

ソスvソスソスソスbソスgソスtソスHソス[ソスソスソスフ補足

ソスソスソスヘに対ゑソスソスソステ難ソスソスソスソスフ確ソスFソスヘ、ソスOソスソスソスソスソスソスフデソス[ソス^ソスソスソスソスソスソスソスSソストのシソスXソスeソスソスソスノゑソスソスソスソスソスソスソスニなゑソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソスソスハ的ソスネ影ソスソス

 

ソスeソスソスソスソスソスけゑソスヘ茨ソス ソスeソスソス
ソスツ用ソスソス ソス\ソスソスソスソスソスネゑソスソスlソスフ難ソスソスヘにゑソスソスAソスvソスソスソスOソスソスソスソスソスソスソスNソスソスソスbソスVソスソスソスAソスソスソス驍「ソスヘソスソスソスソスソスソスソス CPU ソスソスソスフソスソス\ソス[ソスXソスソスソス゚度ソスノ擾ソスソスすソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB
ソス@ソスソスソスソス ソスUソスソスソスメゑソスソスソスソス\ソス[ソスXソスフ参ソスニを制鯉ソスツ能ソスネ場合ソスAソス@ソスソスソスfソス[ソス^ソスソスヌみ趣ソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB
ソスソスソスSソスソス ソスCソスモのコソス}ソスソスソスhソスソスソスsソスソスソスワめゑソスソスソスソスモゑソスソスソスソスソスヘにゑソスソスAソス\ソスソスソスソスソスネゑソスソスソスソス@ソスナデソス[ソス^ソス竦ァソスソスtソスソスソス[ソスソスソスソスソスソスソスさゑソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

 

ソスUソスソスソスソスソスけゑソスツ能ソスソス

ソスソスソスソス

ソスソスソスoソスソスi

ソスソスソスソスソステ的ソスソスソスソス
ソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスソスソスsソス\ソスソスソスネイソスソスソスXソス^ソスソスソスXソスヘ、ソスソスソスソスソステ的ソスソスソスヘゑソスソスgソスpソスソスソス驍アソスニで鯉ソスソスoソスツ能ソスナゑソスソスB ソステ的ソスソスソスヘツソス[ソスソスソスヘアソスvソスソスソスPソス[ソスVソスソスソスソスソスソスソスLソスフ難ソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスフ趣ソス@ソスソスヨ撰ソスソスソスソスソス閧キソス驍アソスニゑソスソスツ能ソスナゑソスソスBStrutsソスフようソスネツソス[ソスソスソスヘ、ソステ難ソスソスソスソス`ソスFソスbソスNソスフフソスソスソス[ソスソスソスソスソス[ソスNソスニゑソスソスト、ソスgソスソスソスンのナソスソスソスbソスWソスソスソスソスソスソストゑソスソスワゑソスソスBソスソスソスソスソスフツソス[ソスソスソスヘ、ソスヨ連ソスソスソスソスxソスソスソスソス}ソスソスソスソスソスソスソスソスAソスxソスソスソスフ優ソスソスxソスソスソスソスソスソスソスソスソスワゑソスソスBソスソスソスソスノゑソスソスAソス\ソスtソスgソスEソスFソスAソスフ難ソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスソスソスソスソスンゑソスソスネゑソスソスモ擾ソスソスノ焦点ソス当てるこソスニゑソスソスツ能ソスナゑソスソスB ソスOソスiソスナ例示ソスソスソスソスソス鼾ソスソスソスソスソスソスソスAソスソスソスソスソステ的ソスソスソスヘは難ソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスソスソスKソスリに行ソスソスソストゑソスソスソス鼾ソスAソス痰ヲソスホ、ソスZソスLソスソスソスソスソスeソスBソスソスeソスソスソスフなゑソスソスxソスソスソスソスAソスRソス[ソスhソスフ変更ソスソスvソスソスソスソスソスネゑソスソスxソスソスソスニゑソスソスソスソスソスソスtソスHソス[ソスソスソスXソス|ソスWソスeソスBソスuソスソスソスソスソスハでゑソスソスネゑソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソス闢ョソステ的ソスソスソスソス
ソスrソスWソスlソスXソスソスソス[ソスソスソスフ具ソスソスソスソスソスソスAソスJソスXソス^ソス}ソスCソスYソスソスソス黷スソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスソスソスvソスソスソスソスソスソスソス鼾ソスヘ、ソステ難ソスソスソスソス`ソスFソスbソスNソスソスソスKソスリに趣ソスソスソスソスソスソスソス驍アソスニゑソスソスmソスFソスソスソス驍スソス゚に手動ソスソスソスヘゑソスソスKソスvソスナゑソスソスB

ソスtソス@ソスWソスソスソスO
ソスtソス@ソスWソスソスソスOソスソス@ソスヘ難ソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスフエソスソスソス[ソスソスソスoソスノ有ソスソスソスナゑソスソスBソス\ソスソスソスソスソスネゑソスソスソスソスヘゑソスソス^ソスソスソスソス黷スソス鼾ソスAソス\ソスtソスgソスEソスFソスAソスヘクソスソスソスbソスVソスソスソスソスソスソスソスソスsソスソスソスソスネ擾ソスヤになゑソスフではなゑソスソスAソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスフコソスソスソスgソスソスソス[ソスソスソスノゑソスソスGソスソスソス[ソスソスソスbソスZソス[ソスWソス生撰ソスソスソスソスラゑソスソスナゑソスソスBソスソスOソスソスCソスソスソス^ソスvソスソスソス^ソスノ撰ソスソスソスソスソスソス黷スソスGソスソスソス[ソスソスソスbソスZソス[ソスWソスソスソスソスソスソスソスソスソスソスソス鼾ソスAソスソスソスヘは鯉ソスソスoソスソスソス黷クソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスソスソスWソスbソスNソスナ擾ソスソスソスソスソスソス黷スソスソスソスニゑソスソスモ厄ソスソスソスソスワゑソスソスB

ソスニ趣ソスネコソス[ソスhソスソス

ソスソス 1:

 

ソスネ会ソスソスフ暦ソスヘ、ソスソスソス[ソスUソスソスソスwソスソスソスソスソス髀、ソスiソスフ撰ソスソスハゑソスソスソスヘゑソスソスAソスソスソスフ難ソスソスヘに奇ソステゑソスソスト搾ソスソスvソスソスソスzソスソスソスvソスZソスソスソスソスVソスソスソスbソスsソスソスソスOソスフ通信ソスノゑソスソスソスソスソスvソスソスソスOソスソスソスソスソスナゑソスソスB

ソスTソスソスソスvソスソスソスソスソスソスF Java ソスiソスソスソスソスソスソスj
...
public static final double price = 20.00;
int quantity = currentUser.getAttribute("quantity");
double total = price * quantity;
chargeUser(total);
ソスc

ソスソスソス[ソスUソスヘ、ソスソスソスiソスフ会ソスソスiソスソスソス゚ゑソス price ソスマ撰ソスソス操作すソス驍アソスニはでゑソスソスワゑソスソスが、ソスソスソスハへ包ソスソスフ値ソスソスソスソスヘゑソスソス驍アソスニは撰ソスソスソスソスソスソスソストゑソスソスワゑソスソスソスBソスUソスソスソスメゑソスソスソスソスフ値ソスソスソスソスヘゑソスソスソスソス鼾ソスAソスソスソスソスフ茨ソスソスソスソスソスソスニゑソスソスフ托ソスソスソスノ、ソスUソスソスソスメの鯉ソスソスソスソスヨ難ソスソスソスソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

 

ソスソス 2:

 

ソスネ会ソスソスフ暦ソスナは、100ソスソスソスソスソスソスソスナ托ソスハ積とゑソスソスソスQソス[ソスソスソスユの包ソスソスニ搾ソスソスソス (mソス~n) ソスソスソスソスソス[ソスUソスフ難ソスソスヘにゑソスソスソス゚まゑソスソスB

ソスTソスソスソスvソスソスソスソスソスソスF C ソスiソスソスソスソスソスソスj
...
#define MAX_DIM 100
...
/* board dimensions */
int m,n, error; 
board_square_t *board;
printf("Please specify the board height: ¥n");
error = scanf("%d", &m);
if ( EOF == error ){
die("No integer passed: Die evil hacker!¥n");
}
printf("Please specify the board width: ¥n");
error = scanf("%d", &n);
if ( EOF == error ){
die("No integer passed: Die evil hacker!¥n");
}
if ( m > MAX_DIM || n > MAX_DIM ) {
die("Value too large: Die evil hacker!¥n");
}
board = (board_square_t*) malloc( m * n * sizeof(board_square_t));
...

ソスソスソスフコソス[ソスhソスナは、ソスソスソス[ソスUソスソスソス蛯ォソスネ撰ソスソスフ値ソスフ難ソスソスヘゑソスソスmソスFソスソスソス驍アソスニで、ソスソスソスソスソスソスソスフ擾ソスソスソス゚托ソスソスソスhソスソスソスナゑソスソスワゑソスソスソスソスAソスソスソスフ撰ソスソスlソスノ対ゑソスソスソスmソスFソスソスソスsソスソスソストゑソスソスワゑソスソスソスBソスソスソスハとゑソスソスト、ソスIソス[ソスoソス[ソスtソスソスソス[ソスソスソスネゑソスソスソスツの大きソスネ包ソスソスフ値ソスソスソスwソス閧キソス驍アソスニにゑソスソスAソスcソスソスネソスソスソスソスソスソスソスソスソスソス闢厄ソストゑソスソスVソスXソスeソスソスソスソスソスNソスソスソスbソスVソスソスソスソスソスソス resource consumption (CWE-400ソスjソスUソスソスソスソスソスけゑソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB ソスワゑソスソスAソスソスソスノ大きソスネ包ソスソスフ値ソスフ難ソスソスヘにゑソスソス integer overflow (CWE-190) ソスソスソスソスソスソスソスNソスソスソスソスソスAソスソスソスフ値ソスフ茨ソスソスソスソスソスソスノゑソスソス\ソスソスソスソスソスネゑソスソスソスソスソスソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

 

ソスソス 3:

 

ソスネ会ソスソスフ暦ソスナは、ソスソスソス[ソスUソスフ撰ソスソスNソスソスソスソスソスニホソス[ソスソスソスyソス[ソスWソスソス\ソスソスソスソスソスソス PHP ソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスフコソス[ソスhソスソスソスソスソスソスソストゑソスソスワゑソスソスB
ソスTソスソスソスvソスソスソスソスソスソスF PHP ソスiソスソスソスソスソスソスj
$birthday = $_GET['birthday'];
$homepage = $_GET['homepage'];
echo "Birthday: $birthday<br>Homepage: <a href=$homepage>click here</a>"

ソスvソスソスソスOソスソスソス}ソスヘ、$birthday ソスノは難ソスソスtソスフ擾ソスソスソスソスA$homepage ソスノは有ソスソスソスソス URL ソスソスソスソスソス驍アソスニゑソスzソス閧オソストゑソスソスワゑソスソスBソスソスソスソスソスソスソスAソスソスソスフ値ソスソス HTTP ソスソスソスNソスGソスXソスgソスソスソスソス謫セソスソスソス驍スソス゚、ソスUソスソスソスメゑソスソスソスソスソスソスし、birthday ソスソスソス驍「ソスソス homepage ソスノ値ソスソス^ソスソスソスソス <script>ソス^ソスOソスフ難ソスソスソスソスソス URL ソスソスソスQソスメにクソスソスソスbソスNソスソスソスソスソスソスソス鼾ソスAWebソスTソス[ソスoソスソスソスRソスソスソスeソスソスソスcソスソスヤゑソスソスロ、ソスソスソスフスソスNソスソスソスvソスgソスソスソスNソスソスソスCソスAソスソスソスgソスフブソスソスソスEソスUソスナ趣ソスソスsソスソスソスソスワゑソスソスBソスソスソスニゑソス $birthday ソスノ対ゑソスソスソスソスソスヘゑソスソスAソスソスソスソスソスニ「-ソスiソス_ソスbソスVソスソスソスjソスvソスノ撰ソスソスソスソスソスソストゑソスソスニゑソスソストゑソスソスAソスネ会ソスソスフ様ソスネ難ソスソスヘは可能ソスナゑソスソスB

ソスiソスUソスソスソスj
2009-01-09--			

ソスソスソスフデソス[ソス^ソスソス SQL ソスXソスeソス[ソスgソスソスソスソスソスgソスナ使ソスpソスソスソス黷スソス鼾ソスAソスソスソスフ難ソスソスヘ以降ソスフスソスeソス[ソスgソスソスソスソスソスgソスソスソスRソスソスソスソスソスgソスニゑソスソスト茨ソスソスソスソスワゑソスソスBソスRソスソスソスソスソスgソスヘスソスeソス[ソスgソスソスソスソスソスgソスソスソスフ托ソスソスフセソスLソスソスソスソスソスeソスBソスヨ連ソスフソスソスWソスbソスNソス無鯉ソスソスノゑソスソスワゑソスソスBソスソスソスフ場合ソスAソスGソスソスソスRソス[ソスhソスニ難ソスソスヘの妥難ソスソスソスソスmソスFソス併用ソスソスソス驍アソスニで、ソスhソス艫ソスJソスjソスYソスソスソスヘゑソスソスLソスソスソスネゑソスソスフになゑソスワゑソスソスB

ソスソスソスソスノ、XSS (CWE-79) ソスUソスソスソスソスソスソスソス SQL injection (CWE-89) ソスヘ、ソスソスソスフ趣ソズのフソスBソス[ソスソスソスhソスフ防ソス艫ソスJソスjソスYソスソスソスノゑソスソスソスソスソスソスソスン的ソスネ鯉ソスソスハの一部ソスナゑソスソスソスソスソスソスソスワゑソスソスソスBソス@ソスRソス[ソスhソスフ前ソスソスヨ係ソスノゑソスソスソストは、CRLF Injection (CWE-93)ソスAArgument Injection (CWE-88) ソスソスACommand Injection (CWE-77) ソスソスソスソスソスソスソスNソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

 

ソスソス 4:

 

ソスネ会ソスソスフ暦ソスヘ、ソスソスソス[ソスUソスソスソスソス m ソスソス n ソスフ茨ソスgソスフ撰ソスソスソスソスフ難ソスソスヘゑソスソスけ付ソスソスソスソスソスソスフでゑソスソスB

ソスTソスソスソスvソスソスソスソスソスソスF C ソスiソスソスソスソスソスソスj
void parse_data(char *untrusted_input){
int m, n, error;
error = sscanf(untrusted_input, "%d:%d", &m, &n);
if ( EOF == error ){
die("Did not specify integer value. Die evil hacker!¥n");
}
/* proceed assuming n and m are initialized correctly */
}

ソスソスソスフコソス[ソスhソスナはソスソス[ソスUソスノゑソス髀会ソスソスソスソスソスソスソス黷スソスソスソスヘゑソスソスソスA2ソスツゑソス int ソス^ソスフ値ソス抜ゑソスソスoソスソスソスワゑソスソスBソスソスソスソスソスソスソスAソスUソスソスソスメゑソスソスu123:ソスvソスニゑソスソスソスソスlソスソスソスソスヘゑソスソスソスソス鼾ソスAソスマ撰ソス m ソスフみ擾ソスソスソスソスソスソスソスソスソスワゑソスソスB

ソスiソスUソスソスソスj
123:

ソスソスソスフ鯉ソスソスハ、n ソスソスソスgソスpソスソスソスソスソス uninitialized variable (CWE-457) ソスソスソスソスソスソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

 

ソスソス 5:

 

ソスネ会ソスソスフ暦ソスナは、ソスIソスuソスWソスFソスNソスgソスフ配ソスソスソスソスソスソス闢厄ソストるたソス゚、ソスソスソス[ソスUソスフ難ソスソスヘゑソスソスけ趣ソスソスAソスソスソスフ配ソスソス操作しソスワゑソスソスB
ソスTソスソスソスvソスソスソスソスソスソスF Java ソスiソスソスソスソスソスソスj
private void buildList ( int untrustedListSize ){
if ( 0 > untrustedListSize ){
die("Negative value supplied for list size, die evil hacker!");
}
Widget[] list = new Widget [ untrustedListSize ];
list[0] = new Widget();
}

ソスソスソスフ暦ソスナは、ソスソスソス[ソスUソスソスソスwソス閧オソスソスソスlソスソスソス辜奇ソスXソスgソスソスソスソスソスAソスソスソスフ値ソスナはなゑソスソスソスソスニゑソスソスmソスFソスソスソス驍スソス゚チソスFソスbソスNソスソスソスsソスソスソスワゑソスソスBソスソスソスソスソスソスソスA0ソスソスソスソスソスヘゑソスソス黷スソス鼾ソスAソスTソスCソスYソスソス0ソスフ配ソスが撰ソスソスソスソスソスソスソスAソスナ擾ソスソスフ場所ソスノ新ソスソスソスソスWidgetソスソスソスロ托ソスソスソスソスソスワゑソスソスB

 

ソスソスソスソスソスソスソス黷スソスソスソスソス

 

ソスQソスソス ソスレ搾ソス
CVE-2008-5305 Eval injection in Perl program using an ID that should only contain hyphens and numbers.
CVE-2008-2223 SQL injection through an ID that was supposed to be numeric.
CVE-2008-3477 lack of input validation in spreadsheet program leads to buffer overflows, integer overflows, array index errors, and memory corruption.
CVE-2008-3843 insufficient validation enables XSS
CVE-2008-3174 driver in security product allows code execution due to insufficient validation
CVE-2007-3409 infinite loop from DNS packet with a label that points to itself
CVE-2006-6870 infinite loop from DNS packet with a label that points to itself
CVE-2008-1303 missing parameter leads to crash
CVE-2007-5893 HTTP request with missing protocol version number leads to crash
CVE-2006-6658 request with missing parameters leads to information leak
CVE-2008-4114 system crash with offset value that is inconsistent with packet size
CVE-2006-3790 size field that is inconsistent with packet size leads to buffer over-read
CVE-2008-2309 product uses a blacklist to identify potentially dangerous content, allowing attacker to bypass a warning
CVE-2008-3494 security bypass via an extra header
CVE-2006-5462 use of extra data in a signature allows certificate signature forging
CVE-2008-3571 empty packet triggers reboot
CVE-2006-5525 incomplete blacklist allows SQL injection
CVE-2008-1284 NUL byte in theme name cause directory traversal impact to be worse
CVE-2008-0600 kernel does not validate an incoming pointer before dereferencing it
CVE-2008-1738 anti-virus product has insufficient input validation of hooked SSDT functions, allowing code execution
CVE-2008-1737 anti-virus product allows DoS via zero-length field
CVE-2008-3464 driver does not validate input from userland to the kernel
CVE-2008-2252 kernel does not validate parameters sent in from userland, allowing code execution
CVE-2008-2374 lack of validation of string length fields allows memory consumption or buffer over-read
CVE-2008-1440 lack of validation of length field leads to infinite loop
CVE-2008-1625 lack of validation of input to an IOCTL allows code execution
CVE-2008-3177 zero-length attachment causes crash
CVE-2007-2442 zero-length input causes free of uninitialized pointer
CVE-2008-5563 crash via a malformed frame structure
CVE-2008-5285 infinite loop from a long SMTP request
CVE-2008-3812 router crashes with a malformed packet
CVE-2008-3680 packet with invalid version number leads to NULL pointer dereference
CVE-2008-3660 crash via multiple "." characters in file extension

 

ソスソスQソスフ緩和ソスソス

ソスtソスFソス[ソスYソスFソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計

ソス略ソスFソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスAソスソスソスCソスuソスソスソスソスソスAソスtソスソスソス[ソスソスソスソスソス[ソスN
Struts ソスワゑソスソスソス OWASP ESAPI Validation API ソスフようソスネ、ソスソスソスヘの妥難ソスソスソスソスソスソスmソスFソスソスソスソスtソスソスソス[ソスソスソスソスソス[ソスNソスソスソスgソスpソスソスソスト会ソスソスソスソスソスソスBStruts ソスソスソスgソスpソスソスソスソス鼾ソスヘ、CWE-101 ソスJソスeソスSソスソスソスフ脆弱性ソスノ抵ソスソスモゑソスソスト会ソスソスソスソスソスソスB

ソスtソスFソス[ソスYソスFソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計ソスAソスソスソスソス

ソス\ソスtソスgソスEソスFソスAソスノゑソスソスソスソスト信ソスソスソスナゑソスソスネゑソスソスソスソスヘゑソスソスけ付ソスソスソスソスモ擾ソスソスソスSソスト把ソスソスソスソスソストゑソスソスソスソスソスソスソスソスBソスソスFソスpソスソスソスソスソス[ソス^ソスソスソスソスソスソスAcookieソスAソスlソスbソスgソスソスソス[ソスNソスソスソスソスヌみ搾ソスソズ全ソスト、ソスツ具ソスソスマ撰ソスソスADNSソスフ逆ソスソスソスソスソスAソスNソスGソスソスソスソスソスハ、ソスソスソスNソスGソスXソスgソスwソスbソス_ソスAURL ソスRソスソスソス|ソス[ソスlソスソスソスgソスAe-mailソスAソスtソス@ソスCソスソスソスAソスtソス@ソスCソスソスソスソスソスAソスfソス[ソス^ソスxソス[ソスXソスAソスyソスムアソスvソスソスソスPソス[ソスVソスソスソスソスソスノデソス[ソス^ソスソス供ゑソスソスソスSソストの外ソスソスソスVソスXソスeソスソス
ソスソスソスフようソスネ難ソスソスヘゑソス API ソストび出ソスソスソスソスソスヤ接的ソスノ介しソスト行ソスソスソス驍アソスニに抵ソスソスモゑソスソストゑソスソスソスソスソスソスソスソスB

ソスtソスFソス[ソスYソスFソスソスソスソス

ソスSソストの難ソスソスヘは茨ソスソスモのゑソスソスソスソスソスフと想ソス閧オソストゑソスソスソスソスソスソスソスソスBソスdソスlソスノ鯉ソスソスソスソスノ従ソスソスソスソスソスツゑソスソスソスソスソスヘのホソスソスソスCソスgソスソスソスXソスgソスソスソスgソスpソスソスソス體呻ソスAソスソスソスmソスフ受け難ソスソスソスソスソストゑソスソスソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスソス@ソスソスpソスソスソストゑソスソスソスソスソスソスソスソスBソスdソスlソスノ費ソスソスソスソスソスソスソスヘゑソスソスソスソスロゑソスソスソスAソスソスソス驍「ソスヘ難ソスソスヘゑソスソスdソスlソスノ適ソスソスソスソスソスソス`ソスノ変会ソスソスソスソスソスソストゑソスソスソスソスソスソスソスソスBソスuソスソスソスbソスNソスソスソスXソスgソスノ依托ソスソスソスソストゑソスソスワゑソスソスソスソスAソスソスソスモのゑソスソスソスAソスソスソス驍「ソスヘ不ソスソスソスネ難ソスソスヘゑソスTソスソスソスソスソスニのみに依托ソスソスソスソスネゑソスソスナゑソスソスソスソスソスソスソスソスBソスソスソスソスソスソスソスAソスuソスソスソスbソスNソスソスソスXソスgソスヘ予ソスソスソスソスソスソスソスUソスソスソスフ鯉ソスソスmソスソスAソスソスソスソスソスソスソスノ具ソスソスロゑソスソスソスラゑソスソスsソスソスソスネ難ソスソスヘゑソスソスソスソス閧キソスソスロに役立ゑソスソスワゑソスソスB

ソスソスソスヘ値ソスフ妥難ソスソスソスソスソスソス`ソスFソスbソスNソスソスソスソスロ、ソスヨ連ソスソスソスソスソスソスソスネ全ソストの要ソスfソスiソスソスソスソスソスAソスソスソスヘタソスCソスvソスAソスソスソスeソスソスソスソスlソスフ範囲、ソスソスソスヘの過不ソスソスソスAソス\ソスソスソスAソスヨ連ソスソスソスソスtソスBソス[ソスソスソスhソスヤの茨ソスム撰ソスソスAソスyソスムビソスWソスlソスXソスソスソス[ソスソスソスフ茨ソスvソスAソスソスソスjソスノつゑソスソスト考ソスソスソスソスソストゑソスソスソスソスソスソスソスソスBソスrソスWソスlソスXソスソスソス[ソスソスソスフ暦ソスニゑソスソスト、"boat" ソスヘ英ソスソスソスソスソスソスソスソスソスワまなゑソスソスソスソス゚構ソスソスソスIソスノ有ソスソスソスナゑソスソスソスソスAソスソスソスソスソスJソスソスソスメゑソス "red" ソスソス "blue" ソスフようソスネ色ソスフ厄ソスソスOソスソスzソス閧キソスソス鼾ソスノは有ソスソスソスナはなゑソスソスAソスニゑソスソスソスソスソスソスWソスbソスNソスソスソスソスソスソスソスソスソスワゑソスソスB

ソスtソスFソス[ソスYソスFソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計

CWE-602 ソスソスhソスソスソスソスソス゚に、ソスNソスソスソスCソスAソスソスソスgソスソスソスナ行ソスソスソスソスSソストのセソスLソスソスソスソスソスeソスBソス`ソスFソスbソスNソスソスソスTソス[ソスoソスソスソスナゑソスソスソスソスlソスノ行ソスソスソストゑソスソス驍アソスニゑソスソスmソスFソスソスソストゑソスソスソスソスソスソスソスソスBソスUソスソスソスメはチソスFソスbソスNソスソスソスsソスソス黷スソスソスソスニに値ソスソスソスソスソスソスソスすゑソスAソスソスソス驍「ソスヘチソスFソスbソスNソスソスソスソスソスSソスノ擾ソスソスソスソスソスソス驍アソスニで、ソスNソスソスソスCソスAソスソスソスgソスソスソスフチソスFソスbソスNソスソスソスソスソスソスソスソス驍アソスニゑソスソスツ能ソスナゑソスソスBソスソスソスフ場合ソスAソスソスソスソスソスされたソスlソスソスソスTソス[ソスoソスノ托ソスソスMソスソスソスソスワゑソスソスB

ソスTソス[ソスoソスソスソスノ対ゑソスソスAソスNソスソスソスCソスAソスソスソスgソスソスソスナのチソスFソスbソスNソスソスソスナ擾ソスソスソスソスフソスソスソスソスbソスgソスソスソスソスソスネゑソスソス鼾ソスナゑソスソスAソスネ会ソスソスフ点ソスノゑソスソスソスソスト役立ゑソスソスワゑソスソスB
ソスEソスNソスソスソスCソスAソスソスソスgソスソスソスナ具ソスソスロゑソスソスソスソスヘゑソスソスフ不ソスソスソスネ難ソスソスヘゑソスソスTソス[ソスoソスノ受け渡ソスソスソス黷スソス鼾ソスヘ攻ソスソスソスフ抵ソスソスソスナゑソスソスソスツ能ソスソスソスソスソスソスソス驍スソス゚、ソスNソスソスソスソスソスmソスニゑソスソスト機ソス\ソスソスソスワゑソスソスB
ソスEソスNソスソスソスCソスAソスソスソスgソスソスソスナのエソスソスソス[ソス`ソスFソスbソスNソスヘ奇ソスソスメゑソスソスソスソステ難ソスソスネ難ソスソスヘの参ソスlソスニなゑソスtソスBソス[ソスhソスoソスbソスNソスソス供ゑソスソスワゑソスソスB
ソスEソスずソスソスソスナはゑソスソスソスワゑソスソスソスソスAソス\ソスzソスOソスフ難ソスソスヘエソスソスソス[ソスノ対ゑソスソスAソスTソス[ソスoソスソスソスフ擾ソスソスソスソスソスソスヤの削減ソスニなゑソスワゑソスソスB

ソスtソスFソス[ソスYソスFソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計

ソスソスソスモのゑソスソスソスソスソスヘの鯉ソスソスmソスソスoソスヘのエソスソスソスRソス[ソスhソスノゑソスソスソスソスト、ソスuソスソスソスbソスNソスソスソスXソスgソスノゑソスソスソスソスヘの妥難ソスソスソスソスフ確ソスFソスヘ奇ソスソスSソスナはゑソスソスソスワゑソスソスソス(CWE-184)ソスBソスソスツの包ソスソスソスソスソスソスGソスソスソスRソス[ソスhソスソスソスソスソスソス@ソスヘ托ソスソスソスソスソスソスンゑソスソス驍スソス゚、ソスソスソスソスソスニゑソスソスソスソスソスソスソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソスtソスFソス[ソスYソスFソスソスソスソス

ソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスソスソスソスソスソスソスフ擾ソス源ゑソスソスソスgソスン搾ソスソスせソストデソス[ソス^ソスソスソス成ソスソスソスソス鼾ソスAソスfソス[ソス^ソスソスソスソスソスソスソスソスソスソスソスソスナ妥難ソスソスソスソスフ確ソスFソスソスソスsソスソスソストゑソスソスソスソスソスソスソスソスBソスツ々ソスフデソス[ソス^ソスvソスfソスソスソステ難ソスソスソスソスフ確ソスFソスソスハ過ゑソスソスソスソスニゑソスソストゑソスソスAソスgソスン搾ソスソスソスソスソスソスfソス[ソス^ソスソスソステ難ソスソスソスソスフ確ソスFソスソスハ過ゑソスソスソスニは鯉ソスソスソスワゑソスソスソスB

ソスtソスFソス[ソスYソスFソスソスソスソス

ソスCソスソスソス^ソス[ソスvソスソスソス^ソス^ソスソスソス黷ゥソスソスlソスCソスeソスBソスuソスRソス[ソスhソスヨ難ソスソスAソスソスソスソスフバソスCソスiソスソスソスソスソスワゑソスソスソスソスナコソス[ソスhソスソスソスソスソスソスソスnソスソスソス鼾ソスノは、ソスソスソスノ抵ソスソスモゑソスソスト難ソスソスヘの妥難ソスソスソスソスフ確ソスFソスソスソスsソスソスソストゑソスソスソスソスソスソスソスソスBソスソスソスソスoソスCソスiソスソスソスヤで予ソスソスソスソスソスネゑソスソスソスソスン搾ソスpソスソスソスソスソスソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスBソスソスソスソスソスnソスソスソスRソス[ソスhソスソスソスAソスソスソスソスソスnソスソスソスソスフ鯉ソスソスソスノとゑソスソスト予ソスソスソスソスソストゑソスソスネゑソスソスソスソスヘでなゑソスソスソスソスmソスFソスソスソストゑソスソスソスソスソスソスソスソスBソス痰ヲソスホ、Java ソスヘバソスbソスtソス@ソスIソス[ソスoソス[ソスtソスソスソス[ソスフ影ソスソスソスソスソスけにゑソスソスソスソスナゑソスソスソスソスAソスlソスCソスeソスBソスuソスRソス[ソスhソスフ呼び出ソスソスソスノゑソスソスソスソスソス蛯ォソスネ茨ソスソスソスソスフ受け渡ソスソスソスノゑソスソスAソスIソス[ソスoソス[ソスtソスソスソス[ソスソスソスソスソスソスソスNソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソスtソスFソス[ソスYソスFソスソスソスソス

ソスソスソスソスソスから数ソスソスソスヨの変奇ソスソスヨ撰ソスソスソスソスgソスpソスソスソスソスネど、ソスソスソスヘゑソスソス黷スソスfソス[ソス^ソスソス\ソスソスソスソスソス黷スソスfソス[ソス^ソスフ趣ソズに変奇ソスソスソスソスト会ソスソスソスソスソスソスBソスマ奇ソスソスソスヘ、ソスlソスソスソス\ソスソスソスソスソス黷スソスヘ囲に趣ソスソスワゑソスソストゑソスソス驍ゥソスAソスソスソスソスソスフフソスBソス[ソスソスソスhソスヤにゑソスソスソスソスト茨ソスム撰ソスソスソスソスロゑソスソスソストゑソスソス驍ゥソスmソスFソスソスソスト会ソスソスソスソスソスソスB

ソスtソスFソス[ソスYソスFソスソスソスソス

ソステ難ソスソスソスソスソスソスmソスFソスソスソスソスOソスノ難ソスソスヘゑソスソスfソスRソス[ソスhソスソスソスAソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスフ鯉ソスソスンの難ソスソスソスソス\ソスソスソスノ撰ソスソスKソスソスソスソスソスト会ソスソスソスソスソス(CWE-180ソスA CWE-181)ソスBソスワゑソスソスAソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスソスソスソスソスソスソスソスソスヘゑソスソスソスネ擾ソスfソスRソス[ソスhソスソスソストゑソスソスワゑソスネゑソスソス謔、ソスmソスFソスソスソスト会ソスソスソスソスソス(CWE-174)ソスBソスソスソスフようソスネエソスソスソス[ソスヘチソスFソスbソスNソスマみの危険ソスネ難ソスソスヘゑソスソストび搾ソスソズゑソスソスニにゑソスソスAソスzソスソスソスCソスgソスソスソスXソスgソスソスソスソスソスソスソスソス驍アソスニに暦ソスソスpソスソスソスソスワゑソスソスBOWASP ESAPI Canonicalization control ソスフようソスネソスソスCソスuソスソスソスソスソスソスソスgソスpソスソスソスト会ソスソスソスソスソスソスB

ソスソスソスソスネ擾ソスマ会ソスソスソスソスネゑソスソスネゑソスワで難ソスソスヘの撰ソスソスKソスソスソスソスソスJソスソスヤゑソスソスト会ソスソスソスソスソスソスBソスソスソスソスノゑソスソスAソスソスdソスfソスRソス[ソスhソスソズ趣ソスソスソスソス骭サソスロゑソスhソスソスソスソスソスニゑソスソスツ能ソスナゑソスソスBソスソスソスソスソスソスソスソスソスフ場合ソスAソスKソスリにエソスソスソスRソス[ソスhソスソスソス黷スソス険ソスネコソスソスソスeソスソスソスcソスソスソスワむ難ソスソスヘゑソスソスソスソスソスソスソスソスソスソストゑソスソスワゑソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソスtソスFソス[ソスYソスFソスソスソスソス

ソスRソスソスソス|ソス[ソスlソスソスソスgソスヤでデソス[ソス^ソスソスソスソスソスソス閧キソスソス鼾ソスAソスソスソスソスソスフコソスソスソス|ソス[ソスlソスソスソスgソスソスソスソスソスソスソスソスソスソスソスGソスソスソスRソス[ソスhソスソスソスsソスソスソストゑソスソス驍アソスニゑソスソスmソスFソスソスソスト会ソスソスソスソスソスソスBソスソスソス黷シソスソスフイソスソスソス^ソス[ソスtソスFソス[ソスXソスノゑソスソスソスソスト、ソスKソスリにエソスソスソスRソス[ソスfソスBソスソスソスOソスソスソスsソスソスソストゑソスソス驍アソスニゑソスソスmソスFソスソスソストゑソスソスソスソスソスソスソスソスBソスvソスソスソスgソスRソスソスソスソスツ能ソスネ鯉ソスソスソスAソスGソスソスソスRソス[ソスhソス明趣ソスソスIソスノ設定しソスト会ソスソスソスソスソスソスB

ソスtソスFソス[ソスYソスFソスeソスXソスg

ソス{ソスニ弱性ソスソスソスソスソスoソスツ能ソスネ趣ソスソスソスソステ的ソスソスソスヘツソス[ソスソスソスソスソスgソスpソスソスソストゑソスソスソスソスソスソスソスソスBソスナ近の托ソスソスソスソスフ趣ソス@ソスヘ、ソスtソスHソス[ソスソスソスXソス|ソスWソスeソスBソスuソスソスソスナ擾ソスソスソスソスソスソス驍スソス゚にデソス[ソス^ソスtソスソスソス[ソスソスソスヘゑソスソスgソスpソスソスソストゑソスソスワゑソスソスBソスcソス[ソスソスソスノゑソスソス 100% ソスフ撰ソスソスxソスソスJソスoソス[ソスフ範囲は趣ソスソスソスソスsソスツ能ソスナゑソスソス驍スソス゚、ソスソスソスソスソスネ会ソスソスソスソスソスナはゑソスソスソスワゑソスソスソスB

ソスtソスFソス[ソスYソスFソスeソスXソスg

ソスtソス@ソスYソスeソスXソスg(ソスtソス@ソスWソスソスソスO)ソスAソスソスソスoソスXソスgソスlソスXソスeソスXソスg(ソス謖抵ソスソスソスフテソスXソスg)ソスソスAソスtソスHソス[ソスソスソスgソスCソスソスソスWソスFソスNソスVソスソスソスソス(ソスGソスソスソス[ソスソスソスざソスニ起ソスソスソスソスソスeソスXソスg)ソスソスソスAソスソスソス多ソスlソスネ難ソスソスヘゑソスソスソスソスツ膨ソスソスネテソスXソスgソスPソス[ソスXソスソスソスgソスpソスソスソストソソスtソスgソスEソスFソスAソス分析ゑソスソスソスAソスソスソスIソスネツソス[ソスソスソスソスZソスpソスソスソスgソスpソスソスソストゑソスソスソスソスソスソスソスソスBソス\ソスtソスgソスEソスFソスAソスフ擾ソスソスソスソスソスソスxソスヘ低下ソスソスソスワゑソスソスソスソスAソスソスソスソスソスソスソスsソスソスソスソスノなゑソスソスソスソスソスAソスNソスソスソスbソスVソスソスソスソスソスソスAソスsソスソスソスmソスネ鯉ソスソスハゑソスソスoソスソスソスニゑソスソスソスソスソスソスソスソスニはゑソスソスソスワゑソスソスソスB

ソスヨ係ソスソス

 

Nature Type ID Name View(s) this relationship pertains to
ChildOf Category 19 Data Handling Development Concepts (primary)699
ChildOf Weakness Class 693 Protection Mechanism Failure Research Concepts (primary)1000
ChildOf Category 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input Weaknesses in OWASP Top Ten (2004) (primary)711
ChildOf Category 738 CERT C Secure Coding Section 04 - Integers (INT) Weaknesses Addressed by the CERT C Secure Coding Standard (primary)734
ChildOf Category 742 CERT C Secure Coding Section 08 - Memory Management (MEM) Weaknesses Addressed by the CERT C Secure Coding Standard734
ChildOf Category 746 CERT C Secure Coding Section 12 - Error Handling (ERR) Weaknesses Addressed by the CERT C Secure Coding Standard734
ChildOf Category 747 CERT C Secure Coding Section 49 - Miscellaneous (MSC) Weaknesses Addressed by the CERT C Secure Coding Standard734
ChildOf Category 751 Insecure Interaction Between Components Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors (primary)750
CanPrecede Weakness Class 22 Path Traversal Research Concepts1000
CanPrecede Weakness Base 41 Failure to Resolve Path Equivalence Research Concepts1000
CanPrecede Weakness Class 74 Failure to Sanitize Data into a Different Plane (aka 'Injection') Research Concepts1000
CanPrecede Weakness Base 15 External Control of System or Configuration Setting Seven Pernicious Kingdoms (primary)700
ParentOf Category 21 Pathname Traversal and Equivalence Errors Development Concepts (primary)699
ParentOf Weakness Class 73 External Control of File Name or Path Development Concepts (primary)699
Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Class 77 Failure to Sanitize Data into a Control Plane (aka 'Command Injection') Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Base 79 Failure to Preserve Web Page Structure (aka 'Cross-site Scripting') Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Base 89 Failure to Preserve SQL Query Structure (aka 'SQL Injection') Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Base 99 Insufficient Control of Resource Identifiers (aka 'Resource Injection') Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Class 100 Technology-Specific Input Validation Problems Development Concepts (primary)699
Research Concepts (primary)1000
ParentOf Weakness Variant 102 Struts: Duplicate Validation Forms Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Variant 103 Struts: Incomplete validate() Method Definition Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Variant 104 Struts: Form Bean Does Not Extend Validation Class Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Variant 105 Struts: Form Bean Does Not Extend Validation Class Seven Pernicious Kingdoms (primary)700
Research Concepts (primary)1000
ParentOf Weakness Variant 106 Struts: Plug-in Framework not in Use Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Variant 107 Struts: Unused Validation Form Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Variant 108 Struts: Unvalidated Action Form Seven Pernicious Kingdoms (primary)700
Research Concepts (primary)1000
ParentOf Weakness Variant 109 Struts: Validator Turned Off Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Variant 110 Struts: Validator Without Form Field Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Base 111 Direct Use of Unsafe JNI Development Concepts (primary)699
Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Base 112 Missing XML Validation Development Concepts (primary)699
Seven Pernicious Kingdoms (primary)700
Research Concepts (primary)1000
ParentOf Weakness Base 113 Failure to Sanitize CRLF Sequences in HTTP Headers (aka 'HTTP Response Splitting') Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Base 114 Process Control Development Concepts (primary)699
Seven Pernicious Kingdoms (primary)700
Research Concepts (primary)1000
ParentOf Weakness Base 117 Incorrect Output Sanitization for Logs Development Concepts (primary)699
Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Class 119 Failure to Constrain Operations within the Bounds of a Memory Buffer Development Concepts (primary)699
Seven Pernicious Kingdoms (primary)700
ParentOf Compound Element: Composite 120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Base 129 Improper Validation of Array Index Development Concepts (primary)699
Research Concepts (primary)1000
ParentOf Weakness Base 134 Uncontrolled Format String Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Base 170 Improper Null Termination Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Base 190 Integer Overflow or Wraparound Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Base 466 Return of Pointer Value Outside of Expected Range Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Base 470 Use of Externally-Controlled Input to Select Classes or Code (aka 'Unsafe Reflection') Development Concepts (primary)699
Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Variant 554 ASP.NET Misconfiguration: Not Using Input Validation Framework Development Concepts (primary)699
Research Concepts (primary)1000
ParentOf Weakness Variant 601 URL Redirection to Untrusted Site (aka 'Open Redirect') Development Concepts (primary)699
ParentOf Weakness Base 606 Unchecked Input for Loop Condition Development Concepts (primary)699
Research Concepts (primary)1000
ParentOf Weakness Base 621 Variable Extraction Error Development Concepts (primary)699
ParentOf Weakness Variant 622 Unvalidated Function Hook Arguments Development Concepts (primary)699
Research Concepts (primary)1000
ParentOf Weakness Variant 626 Null Byte Interaction Error (Poison Null Byte) Development Concepts (primary)699
Research Concepts (primary)1000
ParentOf Compound Element: Chain 680 Integer Overflow to Buffer Overflow Research Concepts (primary)1000
ParentOf Compound Element: Chain 690 Unchecked Return Value to NULL Pointer Dereference Research Concepts (primary)1000
ParentOf Compound Element: Chain 692 Incomplete Blacklist to Cross-Site Scripting Research Concepts (primary)1000
ParentOf Weakness Variant 781 Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code Development Concepts (primary)699
Research Concepts (primary)1000
ParentOf Weakness Variant 785 Use of Path Manipulation Function without Maximum-sized Buffer Development Concepts (primary)699
Seven Pernicious Kingdoms (primary)700
ParentOf Weakness Variant 789 Uncontrolled Memory Allocation Research Concepts1000
MemberOf View 635 Weaknesses Used by NVD Weaknesses Used by NVD (primary)635
MemberOf View 700 Seven Pernicious Kingdoms Seven Pernicious Kingdoms (primary)700

 

ソスヨ係ソスソスソスフ補足

ソス\ソスzソスソスソスソス驛ソスbソスZソス[ソスWソスフ難ソスソスソスソスノゑソスソスソストは、ソスKソスリな難ソスソスヘ確ソスFソスヘ、ソスソスソス齦カソスソスソスソスソスソスソスbソスZソス[ソスWソスフ意厄ソスソスソスマ会ソスソスソスソスソスソス驍アソスニゑソスソスヤ接的ソスノ防ソスソスソスソスソス゚、CWE-116 ソスニ近ゑソスソスヨ係ソスノゑソスソスソスワゑソスソスBソス痰ヲソスホ、ソスソスソスl ID ソスtソスBソス[ソスソスソスhソスヘ、0-9ソスフ包ソスソスソスソスフみ含まゑソストゑソスソス驍アソスニゑソスソスmソスFソスソスソス驍アソスニで、ソスCソスソスソスWソスFソスNソスVソスソスソスソスソスUソスソスソスソスソスソスソスハ的ソスノ防ソスソスソスソスソスニゑソスソスツ能ソスナゑソスソスB

ソスソスソスソスソスソスソスAソスソスソスRソス`ソスソスソスフテソスLソスXソスgソスネど、ソスソスソスノデソス[ソス^ソスフ趣ソズゑソスソスソスソスソスソスソスソスソスソスソスソスナゑソスソスネゑソスソス鼾ソスAソスソスソスヘ確ソスFソスソスソスソスノ有ソスソスソスナゑソスソスソスニは鯉ソスソスソスワゑソスソスソスB
ソスNソスGソスソスソスノ厄ソスソスソスソスソス}ソスソスソスソスソスソス SQL ソスCソスソスソスWソスFソスNソスVソスソスソスソスソスフシソスiソスソスソスIソスソスソスノ具ソスソスソスソスワゑソスソスBソスuO'Reillyソスvソスヘ英ソスソスナはよくソスソスソス髢シソスソスソスフゑソスソス゚、ソスソスソスヘの妥難ソスソスソスソスフ確ソスFソスソスハ過ゑソスソスソス謔、ソスノ鯉ソスソスソスソスワゑソスソスソスソスAソスAソス|ソスXソスgソスソスソスtソスBソスソスソスワまゑソストゑソスソス驍スソス゚、ソスGソスXソスPソス[ソスvソスソスソスソスソス竭シソスフ擾ソスソスソスソスソスソスソスソスソスKソスvソスソスソスソスソスソスワゑソスソスBソスソスソスフ場合ソスAソスAソス|ソスXソスgソスソスソスtソスBソスソスソスソス闖懶ソスソスソスソスソスニゑソス SQL ソスCソスソスソスWソスFソスNソスVソスソスソスソスソスフソスソスXソスNソスソスソスソスソス轤キソスソスソスニゑソスソスナゑソスソスワゑソスソスソスソスAソスsソスソスソスmソスネ厄ソスソスOソスソスoソス^ソスソスソストゑソスソスワゑソスソスソスソス゚、ソス動ソスソスソスソスソスソスソスソスNソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB.

ソスvソスソスソスソスソスソスソスソス ソスiCWE ソスフ鯉ソスソスソスソスj

ソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスフ趣ソス@ソスソスAソス`ソスFソスbソスNソスソスソスsソスソスソスAソスvソスソスソスPソス[ソスVソスソスソスソスソスノゑソス髟ェソズの鯉ソスソスソスソスヘまゑソスソス\ソスソスソスナはゑソスソスソスワゑソスソスソスBソスソスソス\ソスソスソスソストゑソスソスソスニ弱性ソスフ托ソスソスソスソスヘ、ソスPソスノ「ソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスvソスフ厄ソスソスニゑソスソスソスソスLソスqソスソスソスソスAソス`ソスFソスbソスNソスソス@ソスソスソスソスソスソスAソスソスソスソスソスソスソスツ能ソスネ脆弱性ソスノつゑソスソスト暦ソスソスソスソスソス[ソス゚ゑソスソスソス謔、ソスネ詳細擾ソスソスヘ提供ゑソスソスソストゑソスソスワゑソスソスソスBソステ難ソスソスソスソス`ソスFソスbソスNソスヘ、ソスtソスBソスソスソス^ソスソスソスソスソスOソスソスマ奇ソスソスノゑソス驪ュソスソスソスソスソスAソスソスソスフ托ソスソスフ厄ソスソスソスソスソスソスフ趣ソス@ソスニ対比しソスト、ソス゚度ソスノ具ソスソスソスソスソスソスソストゑソスソスワゑソスソスBvulnerability theory paper ソスソスソスQソスニゑソスソストゑソスソスソスソスソスソスソスソスB

ソスソスソスフ補足

ソスuソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスvソスニゑソスソスソスソスpソスソスヘ極めて茨ソスハ的ソスナゑソスソスソスソスAソスpソスソスフ使ソスソスソスソスソスヘ様ソスXソスナゑソスソスBソスソスソスソスソスツゑソスソスフケソス[ソスXソスナは、ソスソスソス{ソスIソスネ脆弱性ソスソスBソスソスソスノゑソスソス驍スソス゚ゑソスAソスヨ連ソスソスソスソスソスソスソスGソスネ趣ソスソスロゑソスソスBソスソスソスソスソスニゑソスレ的ソスニゑソスソスト使ソスソスソスワゑソスソスB

ソスtソスBソスソスソス^ソスソスソスソスソスOソスAソスソスソスKソスソスソスソスGソスXソスPソス[ソスvソスフようソスネ、ソスソスソスヘゑソスソスKソスリでゑソスソス驍アソスニゑソスソスmソスFソスソスソスソスlソスXソスネ厄ソスソスソスソスソスソスソスiソスソスソスJソスoソス[ソスソスソスソスAソスソスソスソスソスIソスネ用ソスソスニゑソスソストゑソスソスgソスpソスソスソスソスワゑソスソスBソスワゑソスソスAソスソスソスソスソスニ具ソスソスソスソスソスソスソスソスノゑソスソスソスソスト単ソスソスソスノ「ソスソスソスヘゑソスソスマ会ソスソスソスソスソスソスAソスソスソスメゑソスソスソスソスlソスナゑソスソス驍アソスニの確ソスFソスvソスニゑソスソスソスソスモ厄ソスソスナゑソスソスgソスpソスソスソスソストゑソスソスワゑソスソスBCWEソスナはゑソスソスフ具ソスソスソスソスソスソスソスソスフ会ソスソス゚ゑソスソスgソスpソスソスソスワゑソスソスB

ソスソスソスgソスDソスナの包ソスソスソス

 

ソスgソスDソスソスソスワゑソスソスヘ組ソスDソスナの包ソスソスソス ソスmソス[ソスh ID CWEソスフ包ソスソズとの適ソスソスソスx ソスソスソズ厄ソス
7 Pernicious Kingdoms Input validation and representation
OWASP Top Ten 2004 A1 CWE ソスフ包ソスソスソスソスレ搾ソス Unvalidated Input
CERT C Secure Coding ERR07-C Prefer functions that support error checking over equivalent functions that don't
CERT C Secure Coding INT06-C Use strtol() or a related function to convert a string token to an integer
CERT C Secure Coding MEM10-C Define and use a pointer validation function
CERT C Secure Coding MSC08-C Library functions should validate their parameters
WASC 20 Improper Input Handling

 

ソスヨ連ソスソスソスソスUソスソスソスpソス^ソス[ソスソス

 

CAPEC-ID ソスUソスソスソスpソス^ソス[ソスソスソスソス (CAPEC Version 1.5)
3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
7 Blind SQL Injection
8 Buffer Overflow in an API Call
9 Buffer Overflow in Local Command-Line Utilities
10 Buffer Overflow via Environment Variables
13 Subverting Environment Variable Values
14 Client-side Injection-induced Buffer Overflow
22 Exploiting Trust in Client (aka Make the Client Invisible)
24 Filter Failure through Buffer Overflow
28 Fuzzing
31 Accessing/Intercepting/Modifying HTTP Cookies
42 MIME Conversion
43 Exploiting Multiple Input Interpretation Layers
88 OS Command Injection
45 Buffer Overflow via Symbolic Links
46 Overflow Variables and Tags
47 Buffer Overflow via Parameter Expansion
52 Embedding NULL Bytes
53 Postfix, Null Terminate, and Backslash
101 Server Side Include (SSI) Injection
64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
66 SQL Injection
67 String Format Overflow in syslog()
72 URL Encoding
73 User-Controlled Filename
78 Using Escaped Slashes in Alternate Encoding
79 Using Slashes in Alternate Encoding
99 XML Parser Attack
83 XPath Injection
85 Client Network Footprinting (using AJAX/XSS)
86 Embedding Script (XSS ) in HTTP Headers
32 Embedding Scripts in HTTP Query Strings
18 Embedding Scripts in Nonscript Elements
63 Simple Script Injection
71 Using Unicode Encoding to Bypass Validation Logic
80 Using UTF-8 Encoding to Bypass Validation Logic
81 Web Logs Tampering
91 XSS in IMG Tags
104 Cross Zone Scripting
106 Cross Site Scripting through Log Files
108 Command Line Execution through SQL Injection
109 Object Relational Mapping Injection
110 SQL Injection through SOAP Parameter Tampering
171 Variable Manipulation

 

ソスQソスソス

Jim Manico. "Input Validation with ESAPI - Very Important ". 2008-08-15. <http://manicode.blogspot.com/2008/08/input-validation-with-esapi.html>.
"OWASP Enterprise Security API (ESAPI) Project". <http://www.owasp.org/index.php/ESAPI>.
Joel Scambray, Mike Shema and Caleb Sima. "Hacking Exposed Web Applications, Second Edition". Input Validation Attacks. McGraw-Hill. 2006-06-05. 
Jeremiah Grossman. "Input validation or output filtering, which is better?". 2007-01-30. <http://jeremiahgrossman.blogspot.com/2007/01/input-validation-or-output-filtering.html>.
Kevin Beaver. "The importance of input validation". 2006-09-06. <http://searchsoftwarequality.techtarget.com/tip/0,289483,sid92_gci1214373,00.html>.
[REF-11] M. Howard and D. LeBlanc. "Writing Secure Code". Chapter 10, "All Input Is Evil!" Page 341. 2nd Edition. Microsoft. 2002.

ソスロ趣ソス竭ォ

ソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスソス(ソスソスソスソスソスソスソス驍「ソスヘ不ソスKソスリでゑソスソスソスソスソスソスニゑソスソストゑソス)ソスAソスlソスXソスネ脆弱性ソスノ対ゑソスソスソスZソスLソスソスソスAソスJソスソスソスフ一部ソスニゑソスソスト必ソスvソスsソスツ鯉ソスソスナゑソスソスソスAソスワゑソスソスLソスソスソスmソスソスソストゑソスソスワゑソスソスBソス`ソスソスソスIソスノ、ソスoソスbソスtソス@ソスIソス[ソスoソス[ソスtソスソスソス[ソスソス XSS ソスフようソスネ厄ソスソスヘ、ソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスフ厄ソスソスナゑソスソスソスニセソスLソスソスソスソスソスeソスBソスフ撰ソスソスニにゑソスソスソスト包ソスソズゑソスソスソスワゑソスソスBソスソスソスソスソスソスソスAソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスヘ、ソスソスソスフようソスネ厄ソスソスノゑソスソスソスソスト唯ソスソスLソスソスソスネ会ソスソスソスソスソスニゑソスソスソスソスけソスナはなゑソスソスAソスワゑソスソスソスソスソス鼾ソスノは難ソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスナは不ソス\ソスソスソスネケソス[ソスXソスソスソスソスソスソスワゑソスソスBCWE ソス`ソス[ソスソスソスヘ、ソスミとまとめにゑソスソスソストゑソスソス驍アソスソスソスフ違いソスソス Research Concepts view (CWE-1000) ソスノゑソスソスソスソスト撰ソスソスソスソスソスソスnソス゚まゑソスソスソスソスソスソスAソスワゑソスソスソスソスソスソスフ鯉ソスソスソスソスソスソスKソスvソスナゑソスソスB

ソスXソスVソスソスソスソス

[2021ソスN06ソスソス30ソスソス]
   2021ソスN06ソスソス30ソスソスソスソスソス_ソスフデソス[ソス^ソスソスソスソスソスノ、ソスソスソスフ補足ソスフ掲ソスレ位置ソスニ難ソスソスeソスソスマ更
[2011ソスN04ソスソス21ソスソス]
  2010ソスN10ソスソス12ソスソスソスソスソス_ソスフデソス[ソス^ソスソスソスソスソスノ更ソスV
[2009ソスN06ソスソス29ソスソス]
  2009ソスN02ソスソス02ソスソスソスソスソス_ソスフ会ソスソスL URL ソスソスソスソスソスノ作成
    http://cwe.mitre.org/data/definitions/20.html


ソスoソス^ソスソス 2011/04/21

ソスナ終ソスXソスVソスソス 2023/04/04


OSZAR »