CWE Top Most Dangerous Software Weaknesses
cwe.mitre.org
CWE Top Most Dangerous Software Weaknesses
1–10 of 131 posts
Re: CWE Top Most Dangerous Software Weaknesses
#2It's somewhat disheartening as a software developer focused on security that the top four elements are still:
* Out-of-bounds Write
* Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
* Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
* Use After Free
Re: CWE Top Most Dangerous Software Weaknesses
#3It's somewhat disheartening as a software developer focused on security that the top four elements are still: * Out-of-bounds Write * Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') * Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') * Use After Free
"But modern c++ is safe, preventing all those errors is as easy as not making them!..."
Re: CWE Top Most Dangerous Software Weaknesses
#4It's somewhat disheartening as a software developer focused on security that the top four elements are still: * Out-of-bounds Write * Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') * Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') * Use After Free
> mproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
This is often ignored as it simply takes too much time and it often does not hurt much as it’s ‘internal’ (to the company using the saas or whatever).
Re: CWE Top Most Dangerous Software Weaknesses
#5It's somewhat disheartening as a software developer focused on security that the top four elements are still: * Out-of-bounds Write * Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') * Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') * Use After Free
"But modern c++ is safe, preventing all those errors is as easy as not making them!..."
[deleted]
Re: CWE Top Most Dangerous Software Weaknesses
#6It's somewhat disheartening as a software developer focused on security that the top four elements are still: * Out-of-bounds Write * Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') * Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') * Use After Free
"But modern c++ is safe, preventing all those errors is as easy as not making them!..."
In fairness, only 2 of those 4 are actually memory-related.
Re: CWE Top Most Dangerous Software Weaknesses
#7It's somewhat disheartening as a software developer focused on security that the top four elements are still: * Out-of-bounds Write * Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') * Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') * Use After Free
Our industry is ageist and anti-intellectual. These are the symptoms of those.
Re: CWE Top Most Dangerous Software Weaknesses
#8It's somewhat disheartening as a software developer focused on security that the top four elements are still: * Out-of-bounds Write * Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') * Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') * Use After Free
> mproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') This is often ignored as it simply takes too much time and it often does not hurt much as it’s ‘internal’ (to the company using the saas or whatever).
[deleted]
Re: CWE Top Most Dangerous Software Weaknesses
#9It's somewhat disheartening as a software developer focused on security that the top four elements are still: * Out-of-bounds Write * Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') * Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') * Use After Free
"But modern c++ is safe, preventing all those errors is as easy as not making them!..."
Is there some authoritative source for what is considered modern C++ and what is old? Most projects I've seen use a wide mix of C++ features of varying age. If you use some C++23 futures it would not make it modern if you still use C++98 features you not supposed to use.
Re: CWE Top Most Dangerous Software Weaknesses
#10It's somewhat disheartening as a software developer focused on security that the top four elements are still: * Out-of-bounds Write * Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') * Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') * Use After Free
Our industry is ageist and anti-intellectual. These are the symptoms of those.
Maybe not ageist, but I do think it's easier to get younger people to work slavishly and pay them relatively less (on average, not everywhere pays like Bay area).