Klocwork C および C++ チェッカーにマッピングされる 2022 年版 CWE 最も危険なソフトウェアエラー上位 25

ランクおよびID チェッカー名
#01 - CWE-787: Out-of-bounds Write

ABV.ANY_SIZE_ARRAY

ABV.GENERAL

ABV.GENERAL.MULTIDIMENSION

ABV.ITERATOR

ABV.MEMBER

ABV.STACK

ABV.TAINTED

ABV.UNICODE.BOUND_MAP

ABV.UNICODE.FAILED_MAP

ABV.UNICODE.NNTS_MAP

ABV.UNICODE.SELF_MAP

ABV.UNKNOWN_SIZE

CXX.SUSPICIOUS_INDEX_CHECK

CXX.SUSPICIOUS_INDEX_CHECK.CALL

CXX.SUSPICIOUS_INDEX_CHECK.ZERO

NNTS.MIGHT

NNTS.MUST

NNTS.TAINTED

RABV.CHECK

RN.INDEX

SV.FMT_STR.BAD_SCAN_FORMAT

SV.STRBO.BOUND_COPY.OVERFLOW

SV.STRBO.BOUND_COPY.UNTERM

SV.STRBO.BOUND_SPRINTF

SV.STRBO.UNBOUND_COPY

SV.STRBO.UNBOUND_SPRINTF

SV.UNBOUND_STRING_INPUT.CIN

SV.UNBOUND_STRING_INPUT.FUNC

#02 - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

SV.TAINTED.XSS.REFLECTED

#03 - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CXX.SQL.INJECT

#04 - CWE-20: Improper Input Validation

ABV.TAINTED

NNTS.TAINTED

SV.CODE_INJECTION.SHELL_EXEC

SV.TAINTED.ALLOC_SIZE

SV.TAINTED.BINOP

SV.TAINTED.CALL.BINOP

SV.TAINTED.CALL.DEREF

SV.TAINTED.CALL.INDEX_ACCESS

SV.TAINTED.CALL.LOOP_BOUND

SV.TAINTED.DEREF

SV.TAINTED.FMTSTR

SV.TAINTED.INDEX_ACCESS

SV.TAINTED.INJECTION

SV.TAINTED.LOOP_BOUND

SV.TAINTED.PATH_TRAVERSAL

SV.TAINTED.SECURITY_DECISION

#05 - CWE-125: Out-of-bounds Read

ABV.ANY_SIZE_ARRAY

ABV.GENERAL

ABV.GENERAL.MULTIDIMENSION

ABV.ITERATOR

ABV.MEMBER

ABV.STACK

ABV.TAINTED

ABV.UNICODE.BOUND_MAP

ABV.UNICODE.FAILED_MAP

ABV.UNICODE.NNTS_MAP

ABV.UNICODE.SELF_MAP

ABV.UNKNOWN_SIZE

CXX.SUSPICIOUS_INDEX_CHECK

CXX.SUSPICIOUS_INDEX_CHECK.CALL

CXX.SUSPICIOUS_INDEX_CHECK.ZERO

NNTS.MIGHT

NNTS.MUST

NNTS.TAINTED

RABV.CHECK

RN.INDEX

SV.FMT_STR.BAD_SCAN_FORMAT

SV.STRBO.BOUND_COPY.OVERFLOW

SV.STRBO.BOUND_COPY.UNTERM

SV.STRBO.BOUND_SPRINTF

SV.STRBO.UNBOUND_COPY

SV.STRBO.UNBOUND_SPRINTF

SV.UNBOUND_STRING_INPUT.CIN

SV.UNBOUND_STRING_INPUT.FUNC

#06 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

SV.CODE_INJECTION.SHELL_EXEC

SV.TAINTED.INJECTION

#07 - CWE-416: Use After Free

CL.FFM.ASSIGN

CL.FFM.COPY

CL.SELF-ASSIGN

CL.SHALLOW.ASSIGN

CL.SHALLOW.COPY

LOCRET.ARG

LOCRET.GLOB

LOCRET.RET

UFM.DEREF.MIGHT

UFM.DEREF.MUST

UFM.FFM.MIGHT

UFM.FFM.MUST

UFM.RETURN.MIGHT

UFM.RETURN.MUST

UFM.USE.MIGHT

UFM.USE.MUST

#08 - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

SV.DLLPRELOAD.NONABSOLUTE.DLL

SV.DLLPRELOAD.NONABSOLUTE.EXE

SV.DLLPRELOAD.SEARCHPATH

SV.TAINTED.PATH_TRAVERSAL

#09 - CWE-352: Cross-Site Request Forgery (CSRF)

現在、このルールに対する適用可能なチェッカーはありません。

#10 - CWE-434: Unrestricted Upload of File with Dangerous Type

現在、このルールに対する適用可能なチェッカーはありません。

#11 - CWE-476: NULL Pointer Dereference

NPD.CHECK.CALL.MIGHT

NPD.CHECK.CALL.MUST

NPD.CHECK.MIGHT

NPD.CHECK.MUST

NPD.CONST.CALL

NPD.CONST.DEREF

NPD.FUNC.CALL.MIGHT

NPD.FUNC.CALL.MUST

NPD.FUNC.MIGHT

NPD.FUNC.MUST

NPD.GEN.CALL.MIGHT

NPD.GEN.CALL.MUST

NPD.GEN.MIGHT

NPD.GEN.MUST

RNPD.CALL

RNPD.DEREF

#12 - CWE-502: Deserialization of Untrusted Data

現在、このルールに対する適用可能なチェッカーはありません。

#13 - CWE-190: Integer Overflow or Wraparound

NUM.OVERFLOW

NUM.OVERFLOW.DF

SV.TAINTED.BINOP

SV.TAINTED.CALL.BINOP

#14 - CWE-287: Improper Authentication

SV.WEAK_CRYPTO.WEAK_HASH

HCC

HCC.PWD

#15 - CWE-798: Use of Hard-coded Credentials

HCC.PWD

HCC.USER

HCC

#16 - CWE-862: Missing Authorization

現在、このルールに対する適用可能なチェッカーはありません。

#17 - CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

SV.CODE_INJECTION.SHELL_EXEC

SV.TAINTED.INJECTION

#18 - CWE-306: Missing Authentication for Critical Function

現在、このルールに対する適用可能なチェッカーはありません。

#19 - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

ABV.ANY_SIZE_ARRAY

ABV.GENERAL

ABV.GENERAL.MULTIDIMENSION

ABV.ITERATOR

ABV.MEMBER

ABV.STACK

ABV.TAINTED

ABV.UNICODE.BOUND_MAP

ABV.UNICODE.FAILED_MAP

ABV.UNICODE.NNTS_MAP

ABV.UNICODE.SELF_MAP

ABV.UNKNOWN_SIZE

CXX.SUSPICIOUS_INDEX_CHECK

CXX.SUSPICIOUS_INDEX_CHECK.CALL

CXX.SUSPICIOUS_INDEX_CHECK.ZERO

NNTS.MIGHT

NNTS.MUST

NNTS.TAINTED

RABV.CHECK

RN.INDEX

SV.FMT_STR.BAD_SCAN_FORMAT

SV.STRBO.BOUND_COPY.OVERFLOW

SV.STRBO.BOUND_COPY.UNTERM

SV.STRBO.BOUND_SPRINTF

SV.STRBO.UNBOUND_COPY

SV.STRBO.UNBOUND_SPRINTF

SV.UNBOUND_STRING_INPUT.CIN

SV.UNBOUND_STRING_INPUT.FUNC

#20 - CWE-276: Incorrect Default Permissions

SV.USAGERULES.PROCESS_VARIANTS

#21 - CWE-918: Server-Side Request Forgery (SSRF)

現在、このルールに対する適用可能なチェッカーはありません。

#22 - CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

SV.TOCTOU.FILE_ACCESS

#23 - CWE-400: Uncontrolled Resource Consumption

CL.MLK.ASSIGN

CL.MLK.VIRTUAL

CL.MLK

MLK.MIGHT

MLK.MUST

MLK.RET.MIGHT

MLK.RET.MUST

SV.CODE_INJECTION.SHELL_EXEC

SV.TAINTED.INJECTION

#24 - CWE-611: Improper Restriction of XML External Entity Reference

CXX.SV.XXE

#25 - CWE-94: Improper Control of Generation of Code ('Code Injection')

SV.CODE_INJECTION.SHELL_EXEC

SV.TAINTED.INJECTION