Cyver core supports the OWASP TOP 25 Common Weakness Enumeration (CWE) 2024 Checklist. This list provides a crucial, data-driven perspective on the most widespread and critical software weaknesses.
General Information on the OWASP Top 25 CWE
The OWASP Top 25 is a definitive list of the most common and dangerous software flaws, compiled using extensive industry vulnerability data. It is a more technical, enumerated list compared to the high-level OWASP Top 10, focusing on the underlying coding and design defects that directly lead to security vulnerabilities. Compliance with this standard helps developers and security analysts to perform deep, technical root-cause analysis and mitigation.
The Top 25 Most Dangerous Software Weaknesses (2024)
01. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
02. CWE-787: Out-of-bounds Write
03. CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
04. CWE-352: Cross-Site Request Forgery (CSRF)
05. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
06. CWE-125: Out-of-bounds Read
07. CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
08. CWE-416: Use After Free
09. CWE-862: Missing Authorization
10. CWE-434: Unrestricted Upload of File with Dangerous Type
11. CWE-94: Improper Control of Generation of Code ('Code Injection')
12. CWE-20: Improper Input Validation
13. CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
14. CWE-287: Improper Authentication
15. CWE-269: Improper Privilege Management
16. CWE-502: Deserialization of Untrusted Data
17. CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
18. CWE-863: Incorrect Authorization
19. CWE-918: Server-Side Request Forgery (SSRF)
20. CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
21. CWE-476: NULL Pointer Dereference
22. CWE-798: Use of Hard-coded Credentials
23. CWE-190: Integer Overflow or Wraparound
24. CWE-400: Uncontrolled Resource Consumption
25. CWE-306: Missing Authentication for Critical Function
Download
You can directly download the latest OWASP Top 25 CWE Checklist from our GitHub repository: