CWE 2025 Top 25 Most Dangerous Software Errors: Java

ランクおよびID	チェッカー名
#01 - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	SV.XSS.DB SV.XSS.REF
#02 - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	SV.DATA.DB SV.SQL.DBSOURCE SV.SQL
#03 - CWE-352: Cross-Site Request Forgery (CSRF)	SV.CSRF.GET SV.CSRF.ORIGIN SV.CSRF.TOKEN
#04 - CWE-862: Missing Authorization	SPRING.AUTHZ.ABSENT SPRING.AUTHZ.MISSING SV.PRIVILEGE.MISSING JAVA.SV.LLM.VECTOR.NOFILTER
#05 - CWE-787: Out-of-bounds Write	現在、このルールに対する適用可能なチェッカーはありません。
#06 - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	SV.PATH.INJ SV.PATH
#07 - CWE-416: Use After Free	現在、このルールに対する適用可能なチェッカーはありません。
#08 - CWE-125: Out-of-bounds Read	現在、このルールに対する適用可能なチェッカーはありません。
#09 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	SV.EXEC.DIR SV.EXEC.ENV SV.EXEC.LOCAL SV.EXEC
#10 - CWE-94: Improper Control of Generation of Code ('Code Injection')	SV.DATA.DB SV.SQL SV.SQL.DBSOURCE
#11 - CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')	現在、このルールに対する適用可能なチェッカーはありません。
#12 - CWE-434: Unrestricted Upload of File with Dangerous Type	SV.DATA.FILE
#13 - CWE-476: NULL Pointer Dereference	ANDROID.NPE NPE.COND NPE.CONST NPE.RET.UTIL NPE.RET NPE.STAT REDUN.EQNULL REDUN.NULL RNU.THIS
#14 - CWE-121: Stack-based Buffer Overflow	現在、このルールに対する適用可能なチェッカーはありません。
#15 - CWE-502: Deserialization of Untrusted Data	SV.SERIAL.NOFINAL SV.SERIAL.NOREAD SV.SERIAL.NOWRITE SV.SERIAL.OVERRIDE SV.SERIAL.SIG JAVA.SV.LLM.MODEL.DESERIAL
#16 - CWE-122: Heap-based Buffer Overflow	現在、このルールに対する適用可能なチェッカーはありません。
#17 - CWE-863: Incorrect Authorization	SV.PRIVILEGE.MISSING
#18 - CWE-20: Improper Input Validation	ANDROID.LIFECYCLE.SV.GETEXTRA SV.DOS.ARRINDEX SV.HTTP_SPLIT SV.INT_OVF SV.LDAP SV.LOADLIB.INJ SV.LOG_FORGING SV.STRUTS.NOTVALID SV.STRUTS.VALIDMET SV.TAINT_NATIVE SV.TAINT JAVA.SV.XML.INVALID
#19 - CWE-284: Improper Access Control	SV.EXPOSE.FIELD SV.EXPOSE.IFIELD SV.EXPOSE.MUTABLEFIELD SV.PRIVILEGE.MISSING SV.SHARED.VAR
#20 - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor	SV.IL.DEV SV.IL.FILE SV.IL.SESSION SV.IL.SESSION.CLIENT SV.EXPOSE.RET SV.EXPOSE.STORE SV.LOG_FORGING SV.SENSITIVE.DATA SV.SENSITIVE.OBJ
#21 - CWE-306: Missing Authentication for Critical Function	SPRING.AUTHC.ABSENT SPRING.AUTHC.MISSING
#22 - CWE-918: Server-Side Request Forgery (SSRF)	SV.SSRF.URI
#23 - CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')	SV.EXEC.DIR SV.EXEC.ENV SV.EXEC.LOCAL SV.EXEC
#24 - CWE-639: Authorization Bypass Through User-Controlled Key	SV.AUTH.BYPASS.MIGHT SV.AUTH.BYPASS.MUST
#25 - CWE-770: Allocation of Resources Without Limits or Throttling	JD.INF.ALLOC SV.DOS.ARRSIZE SV.DOS.TMPFILEDEL SV.DOS.TMPFILEEXIT JAVA.SV.LLM.CLIENT.NOTIMEOUT JAVA.SV.LLM.INPUT.UNBOUNDED