2010 Top 25 - Porous Defenses
A category in the Common Weakness Enumeration published by The MITRE Corporation.
Categories in the Common Weakness Enumeration (CWE) group entries based on some common characteristic or attribute.
Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.
The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
The software does not encrypt sensitive or critical information before storage or transmission.
The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypas...
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to exte...
Deprecated or Obsolete
CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is availa...