2019 CWE Top 25 Most Dangerous Software Errors

ronjor · Sep 17, 2019

Original release date: September 17, 2019

MITRE has released the 2019 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Errors list. The Top 25 is a compilation of the most frequent and critical errors that can lead to serious vulnerabilities in software. An attacker can often exploit these vulnerabilities to take control of an affected system, obtain sensitive information, or cause a denial-of-service condition.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Top 25 list and evaluate recommended mitigations to determine those most suitable to adopt.
Click to expand...

guest · Nov 27, 2019

Top 25 Most Dangerous Vulnerabilities Refreshed After 8 Years
November 27, 2019
https://www.bleepingcomputer.com/ne...rous-vulnerabilities-refreshed-after-8-years/

For the first time in eight years, the list with the most dangerous 25 software vulnerabilities received an update that promises to be relevant for current times.
The entries were selected based on objective criteria compared to the previous list, considering reports from security researchers along with prevalence, severity, and exploitation in the real-world.
Compiling this list was a data-driven process relying on publicly reported vulnerabilities in the National Vulnerabilities Database (NVD).

The purpose of the update is to help improve cybersecurity resiliency. The list is intended as a guidance document designed to help developers build more secure software before releasing it on the market. ChrisLevendis, says in a blog post today that the data-driven approach reflects the problems seen in the real world.
Click to expand...

Snapshot: Top 25 Most Dangerous Software Errors

guest · Nov 29, 2019

New MITRE software error list is a mixed bag, says infosec community
November 27, 2019
https://www.scmagazineuk.com/new-mi...ed-bag-says-infosec-community/article/1667214

It acts as a "demonstrative list" of what have been calculated to be the "most widespread and critical weaknesses" leading to serious software vulnerabilities.

So, what do infosec professionals make of the new list bearing all this in mind? Are these really the most dangerous software errors, or has MITRE got it wrong?
Israel Barak, chief information security officer at Cybereason, agrees in general with the new CWE classifications, but argues that the "CVE database has a bias built into it that might make the CWE scoring mechanism less effective in the real world".

The bias is that the information in the CVE data is contributed by the good guys and not the bad guys, he explains. "Very often, the good guys encounter the vulnerabilities that are easier to find. Hence the good guys are likely to report a larger number of less impactful findings." [...]
Click to expand...

ronjor · Feb 26, 2020

New CWE List of Common Security Weaknesses

Original release date: February 26, 2020
MITRE has released version 4.0 of the community-developed Common Weakness Enumeration (CWE) list. Previous CWE list versions describe common software security weaknesses. With version 4.0, the CWE list expands to include hardware security weaknesses. Additionally, version 4.0 simplifies the presentation of weaknesses into various views and adds a search function to enable easier navigation of the information.
The Cybersecurity and Infrastructure Security Agency (CISA) sponsors MITRE’s CWE program, which is a community-based initiative. CISA welcomes new partners to the CWE program. Visit https://cwe.mitre.org to learn how to get involved.
Click to expand...

Log in or Sign up

2019 CWE Top 25 Most Dangerous Software Errors

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

Log in or Sign up

2019 CWE Top 25 Most Dangerous Software Errors

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

Useful Searches