Popis najraširenijih 25 kritičnih programerskih grešaka koje mogu dovesti do ranjivosti softvera objavila je MITRE korporacija kako bi programerima i korisnicima pomogla u stvaranju što sigurnijeg softvera.
Greške koje se navode u dokumentu često je lako pronaći i zloupotrijebiti, a opasne su jer u velikom broju slučajeva napadačima omogućuju potpunu kontrolu nad softverom, krađu podatak ili potpunu nefunkcionalnost.
Stvaranje popisa rezultat je suradnje SANS Instituta, MITRE korporacije i niza sigurnosnih stručnjaka iz SAD-a i Europe.
Donosimo listu s pogreškama koje navodimo na engleskom jeziku, dok više informacija možete saznati na stranicama korporacije: http://cwe.mitre.org/top25/index.html
Failure to Preserve Web Page Structure ('Cross-site Scripting')
Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Cross-Site Request Forgery (CSRF)
Improper Access Control (Authorization)
Reliance on Untrusted Inputs in a Security Decision
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Unrestricted Upload of File with Dangerous Type
Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection')
Missing Encryption of Sensitive Data
Use of Hard-coded Credentials
Buffer Access with Incorrect Length Value
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP File Inclusion')
Improper Validation of Array Index
Improper Check for Unusual or Exceptional Conditions
Information Exposure Through an Error Message
Integer Overflow or Wraparound
Incorrect Calculation of Buffer Size
Missing Authentication for Critical Function
Download of Code Without Integrity Check
Incorrect Permission Assignment for Critical Resource
Allocation of Resources Without Limits or Throttling
URL Redirection to Untrusted Site ('Open Redirect')
Use of a Broken or Risky Cryptographic Algorithm
Race Condition
