SANS TOP 25
SANS TOP 25 Most Dangerous Software Errors is a list of the most common and dangerous software vulnerabilities. It is kept up by the SANS Institute, a well-known provider of cybersecurity training and certification. The Common Vulnerabilities and Exposures (CWE) catalogue, a dictionary of typical software weaknesses and vulnerabilities, provided the information used to create the list.
The SANS TOP 25 is based on a variety of factors, including the prevalence of vulnerabilities in the real world, the severity of their impact, and the ease with which they can be exploited.
The SANS TOP 25 is updated annually to reflect the latest trends in the cybersecurity landscape. The current list for 2023 is as follows:
- CWE-787 : Out-of-bounds Write.
- CWE-79 : Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’).
- CWE-89 : Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’).
- CWE-416 : Use After Free.
- CWE-78 : Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’).
- CWE-20 : Improper Input Validation.
- CWE-125 : Out-of-bounds Read.
- CWE-22 : Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’).
- CWE-352 : Cross-Site Request Forgery (CSRF).
- CWE-434 : Unrestricted Upload of File with Dangerous Type.
- CWE-862 : Missing Authorization.
- CWE-476 : NULL Pointer Dereference.
- CWE-287 : Improper Authentication.
- CWE-190 : Integer Overflow or Wraparound.
- CWE-502 : Deserialization of Untrusted Data.
- CWE-77 : Improper Neutralization of Special Elements used in a Command (‘Command Injection’).
- CWE-119 : Improper Restriction of Operations within the Bounds of a Memory Buffer.
- CWE-798 : Use of Hard-coded Credentials.
- CWE-918 : Server-Side Request Forgery (SSRF).
- CWE-306 : Missing Authentication for Critical Function.
- CWE-362 : Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’).
- CWE-269 : Improper Privilege Management.
- CWE-94 : Improper Control of Generation of Code (‘Code Injection’).
- CWE-863 : Incorrect Authorization.
- CWE-276 : Incorrect Default Permissions
By understanding and mitigating the SANS TOP 25 Most Dangerous Software Errors, organizations can significantly reduce their risk of being exploited by attackers.
#Cybersecurity Senselearner Technologies Pvt Ltd
