2009 Top 25 - Risky Resource Management

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

The product allows user input to control or influence paths or file names that are used in filesystem operations.

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralize...

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

The product does not release or incorrectly releases a resource before it is made available for re-use.

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is availa...