1. Insecure Interaction Between Components
   1. CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
      1. Mission/Business Risk
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-6: TCP Header
         2. CAPEC-15: Command Delimiters
         3. CAPEC-43: Exploiting Multiple Input Interpretation Layers
         4. CAPEC-88: OS Command Injection
         5. CAPEC-108: Command Line Execution through SQL Injection
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. ENV03-C: Sanitize the environment when invoking external programs
            2. ENV04-C: Do not call system() if you do not need a command processor
            3. STR02-C: Sanitize data passed to complex subsystems
            4. IDS07-J: Do not pass untrusted, unsanitized data to the Runtime.exec() method
            5. STR02-CPP: Sanitize data passed to complex subsystems
            6. ENV03-CPP: Sanitize the environment when invoking external programs
            7. ENV04-CPP: Do not call system() if you do not need a command processor
   2. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
      1. Mission/Business Risk
      2. COmmon Attack Pattern Enumeration & Classification
         1. CAPEC-18: Embedding Scripts in Nonscript Elements
         2. CAPEC-19: Embedding Scripts within Scripts
         3. CAPEC-32: Embedding Scripts in HTTP Query Strings
         4. CAPEC-63: Simple Script Injection
         5. CAPEC-85: Client Network Foot printing (using AJAX/XSS)
         6. CAPEC-86: Embedding Script (XSS ) in HTTP Headers
         7. CAPEC-91: XSS in IMG Tags
         8. CAPEC-106: Cross-Site Scripting through Log Files
         9. CAPEC-198: Cross0-Site Scripting In Error Pages
         10. CAPEC-199: Cross-Site Scripting Using Alternate Syntax
         11. CAPEC-209: Cross-Site Scripting Using MIME Type Mismatch
         12. CAPEC-232: Exploitation of Privilege/Trust
         13. CAPEC-243: Cross-Site Scripting in Attributes
         14. CAPEC-244: Cross-Site Scripting via Encoded URI Schemes
         15. CAPEC-245: Cross-Site Scripting Using Doubled Characters, e.g. %3C%3Cscript
         16. CAPEC-246: Cross-Site Scripting Using Flash
         17. CAPEC-247: Cross-Sight Scripting with Masking through Invalid Characteristics in Identifiers
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. No CERT Coding Rules corresponding to this CWE entry.
   3. CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-7: Blind SQL Injection
         2. CAPEC-66: SQL Injections
         3. CAPEC-108: Command Line Execution through SQL Injection
         4. CAPEC-109: Object Relational Mapping Injection
         5. CAPEC-110: SQL Injection through SOAP Parameter Tampering
         6. CAPEC-470: Expanding Control over the OS from the Database
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. No CERT Coding Rules corresponding to this CWE entry.
   4. CWE-352: Cross-Site Request Forgery (CSRF)
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-62: Cross Site Request Forgery (aka Session Riding)
         2. CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
         3. CAPEC-452:Cross-Domain Search Timing
         4. CAPEC-467: Cross SIte Identification
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. No CERT Coding Rules corresponding to this CWE entry.
   5. CWE: 434: Unrestricted Upload of File with Dangerous Type
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
         2. CAPEC-122: Exploitation of Authorization
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. No CERT Coding Rules corresponding to this CWE entry.
   6. CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-194 Fake the Source of Data
      3. Prevention & Mitigation & Classification
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. No CERT Coding Rules corresponding to this CWE entry.
2. Risky Resource Management
   1. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-23: File System Function Injection, Content Based
         2. CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic
         3. CAPEC-76: Manipulating Input to FIle System Calls
         4. CAPEC-78: Using Escaped Slashes in Alternate Encoding
         5. CAPEC-79: Using Slashes in Alternate Encoding
         6. CAPEC-139: Relative Path Traversal 
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing & Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. FIO02-C: Canonicalize path names originating from untrusted sources
            2. FIO02-CPP: Canonicalize path names originating from untrusted sources
   2. CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-8: Buffer Overflow in an API Call
         2. CAPEC-9: Buffer Overflow in Local Command-Line Utilities
         3. CAPEC-10: Buffer Overflow via Environment Variables
         4. CAPEC-14: Client-side Injection-Induced Buffer Overflow
         5. CAPEC-24: Filter Failure through Buffer Overflow
         6. CAPEC-42: MIME Conversion
         7. CAPEC-44: Overflow Binary Resource File
         8. CAPEC-45: Buffer Overflow via Symbolic Links
         9. CAPEC-46: OVerflow Variables and Tags
         10. CAPEC-47: Buffer Overflow via Parameter Expansion
         11. CAPEC-67: String Format Overflow in syslog()
         12. CAPEC-92: Forced Integer Overflow
         13. CAPEC-100: Overflow Buffers
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing & Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. STR35-C: Do not copy data from an unbounded source to a fixed-length array
            2. STR35-CPP: Do not copy data from an unbounded source to a fixed-length array
   3. CWE-131: Incorrect Calculation of Buffer Size
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-47: Buffer Overflow via Parameter Expansion
         2. CAPEC-100: Overflow Buffers
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing & Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. MEM35-C: Allocate sufficient memory for an object
            2. MEM35-CPP: Allocate sufficient memory for an object
   4. CWE-134: Uncontrolled Format String
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-67: String Format Overflow in syslog()
         2. CAPEC-135: Format String Injection
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing & Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. FIO30-C: Exclude user input from format strings
            2. FIO30-C: Exclude user input from format strings
            3. IDS06-J: Exclude user input from format strings
            4. FIO30-CPP: Exclude user input from format strings
   5. CWE-190: Integer Overflow or Wraparound
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-92: Forced Integer Overflow
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing & Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. INT03-C: Use a secure integer library
            2. INT30-C: Ensure that unsigned integer operations do not wrap
            3. INT32-C: Ensure that operations on signed integers do not result in overflow
            4. INT35-C: Evaluate integer expressions in a larger size before comparing or assigning to that size
            5. MEM07-C: Ensure that the arguments to calloc(), when multiplied, can be represented as a size_t
            6. MEM35-C: Allocate sufficient memory for an object
            7. INT03-CPP: Use a secure integer library
            8. INT30-CPP: Ensure that unsigned integer operations do not wrap
            9. INT32-CPP: Ensure that operations on signed integers do not result in overflow
            10. NT35-CPP: Evaluate integer expressions in a larger size before comparing or assigning to that size
            11. MEM07-CPP: Ensure that the arguments to calloc(), when multiplied, can be represented as a size_t
            12. MEM35-CPP: Allocate sufficient memory for an object
   6. CWE- 494: Download of Code Without Integrity Check
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-184: Software Integrity Attack
         2. CAPEC-185: Malicious Software Download
         3. CAPEC-186: Malicious Software Update
         4. CAPEC-187: Malicious Automated Software Update
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. SEC06-J: Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar
   7. CWE-676: Use of Potentially Dangerous Function
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-113: API Abuse/Misuse
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, & Documentation
         3. Installation, Operation & System Configuration
         4. Associated CERT Coding Rules
            1. ERR07-C: Prefer functions that support error checking over equivalent functions that don't
            2. FIO01-C: Be careful using functions that use file names for identification
            3. INT06-C: Use strtol() or a related function to convert a string token to an integer
            4. INT06-CPP: Use strtol() or a related function to convert a string token to an integer
            5. FIO01-CPP: Be careful using functions that use file names for identification
   8. CWE-829: Inclusion of Functionality from Untrusted Control Sphere
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-38: Leveraging/Manipulating Configuration File Search Paths
         2. CAPEC-101: Server Side Include (SSI) Injection
         3. CAPEC-103: Clickjacking
         4. CAPEC-111: JSON HIjacking (aka JavaScript Hijacking)
         5. CAPEC-175: Code Injection
         6. CAPEC-181: Flash File Overlay
         7. CAPEC-184: Software Integrity Attacks
         8. CAPEC-185: Malicious Software Download
         9. CAPEC-193: PHP Remote File Inclusion
         10. CAPEC-222: iFrame Overlay
         11. CAPEC-251: Local File Inclusion
         12. CAPEC-252: PHP Local File Inclusion
         13. CAPEC-253: Remote Code Inclusion
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. No CERT Coding Rules corresponding to this CWE entry.
3. Porous Defenses
   1. CWE-250: Execution with Unnecessary Privileges
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-69: Target Programs with Elevated Privileges
         2. CAPEC-104: Cross Zone Scripting
         3. CAPEC-470: Expanding Control over the OS from the Database
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. SER09-J: Minimize privileges before deserializing from a privilege context
   2. CWE-306: Missing Authentication for Critical Functions
      1. Mission/Business Risk
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-12: Choosing a Message/Channel Identifier on a Public/Multicast Channel
         2. CAPEC-36: Using Unpublished Web Service APIs
         3. CAPEC-40: Manipulating Writeable Terminal Devices
         4. CAPEC-62: Cross Site Request Forgery (aka Session Riding)
         5. CAPEC-225: Exploitation of Authentication
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. No CERT Coding Rules corresponding to this CWE entry.
   3. CWE-307: Improper Restriction of Excessive Authentication Attempts
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-16: Dictionary-based Password Attack
         2. CAPEC-49: Password Brute Forcing
         3. CAPEC-55: Rainbow Table Password Cracking
         4. CAPEC-70: Try Common(default) Usernames & Passwords
         5. CAPEC-112: Brute Force
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. No CERT Coding Rules corresponding to this CWE entry
   4. CWE-311: Missing Encryption of Sensitive Data
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies
         2. CAPEC-37: Lifting Data Embedded in Client Distributions
         3. CAPEC-65: Passively Sniff and Capture Application Code Bound for Authorized Client
         4. CAPEC-117: Data Interception Attacks
         5. CAPEC-155: Screen Temporary Files for Sensitive Information
         6. CAPEC-157: Sniffing Attacks
         7. CAPEC-167: Lifting Sensitive Data from the Client
         8. CAPEC-204: Lifting cached, sensitive data embedded in client distributions (thick or thin)
         9. CAPEC-205: Lifting credential(s)/key material embedded in client distributions (thick or thin)
         10. CAPEC-258: Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Dynamic Update
         11. CAPEC-259: Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Patching
         12. CAPEC-260: Passively Sniffing and Capturing Application Code Bound for an Authorized Client During Initial Distribution
         13. CAPEC-383: Harvesting Usernames or UserIDs via Application API Event Monitoring
         14. CAPEC-384: Application API Message Manipulation via Man-in-the-Middle
         15. CAPEC-385: Transaction or Event Tampering via Application API Manipulation
         16. CAPEC-386: Application API Navigation Remapping
         17. CAPEC-387: Navigation Remapping To propagate Malicious Content
         18. CAPEC-388: Application API Button Hijacking
         19. CAPEC-389: Content Spoofing via Application API Manipulation
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. MSC00-J: Use SSLSocket rather than Socket for secure data exchange
   5. CWE-327: Use of a Broken or Risky Cryptographic Algorithm
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-20: Encryption Brute Force
         2. CAPEC-97: Cryptanalysis
         3. CAPEC-459: Creating a Rogue Certificate Authority Certificate
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. MSC02-J: Generate strong random numbers
            2. MSC30-CPP: Do not use the rand() function for generating pseudorandom numbers
            3. MSC32-CPP: Ensure your random number generator is properly seeded
   6. CWE-732: Incorrect Permission Assignment for Critical Resource
      1. Mission/Business Risks
      2. Common Attack Patterns Enumeration & Classification
         1. CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
         2. CAPEC-17: Accessing, Modifying or Executing Executable Files
         3. CAPEC-60: Reusing Session IDs (aka Session Replay)
         4. CAPEC-61: Session Fixation
         5. CAPEC-62: Cross Site Request Forgery (aka Session Riding)
         6. CAPEC-122: Exploitation of Authorization
         7. CAPEC-127: Directory Indexing
         8. CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
         9. CAPEC-232: Exploitation of Privilege/Trust
         10. CAPEC-234: Hijacking a privileged process
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. FIO03-J: Create files with appropriate access permission
            2. SEC01-J: Do not allow tainted variables in privileged blocks
            3. ENV03-J: Do not grant dangerous combinations of permissions
            4. FIO06-CPP: Create files with appropriate access permissions
            5. FIO06-C: Create files with appropriate access permissions
   7. CWE-759: Use of a One-Way Hash without a Salt
      1. Mission/Business Risks
      2. Common Attack Patterns Enumeration & Classification
         1. CAPEC-20: Encryption Brute Forcing
         2. CAPEC-55: Rainbow Table Password Cracking
         3. CAPEC-97: Cryptanalysis
      3. Prevention & Mitigation Practice
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. No CERT Coding Rules corresponding to this CWE entry.
   8. CWE-798: Use of Hard-coded Credentials
      1. Mission/Business Risks
      2. Common Attack Patterns Enumeration & Classification
         1. CAPEC-70: Try Common (default) Usernames and Passwords
         2. CAPEC-188: Reverse Engineering
         3. CAPEC-189: Software Reverse Engineering
         4. CAPEC-190: Reverse Engineering an Executable to Expose Assumed Hidden Functionality or Content
         5. CAPEC-191: Read Sensitive Strings Within an Executable
         6. CAPEC-205: Lifting credential(s)/Key material embedded in client distributions (thick or thin)
      3. Prevention & Mitigation Practice
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. MSC03-J: Never hard code sensitive information
   9. CWE-807: Reliance on Untrusted Inputs in a Security Decision
      1. Mission/Business Risks
      2. Common Attack Pattern Enumeration & Classification
         1. CAPEC-232: Exploitation of Privilege/Trust
      3. Prevention & Mitigation Practices
         1. Requirements, Architecture & Design
         2. Build, Compilation, Implementation, Testing, and Documentation
         3. Installation, Operation and System Configuration
         4. Associated CERT Coding Rules
            1. ENV03-CPP: Sanitize the environment when invoking external programs
            2. SEC09-J: Do not base security checks on untrusted sources
   10. CWE-862: Missing Authentication
       1. Mission/Business Risk
       2. Common Attack Pattern Enumeration & Classification
          1. CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
          2. CAPEC-17: Accessing, Modifying or Executing Executable Files
          3. CAPEC-58: Restful Privilege Elevation
          4. CAPEC-122: Exploitation of Authorization
          5. CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
       3. Prevention & Mitigation Practices
          1. Requirements, Architecture & Design
          2. Build, Compilation, Implementation, Testing, and Documentation
          3. Installation, Operation and System Configuration
          4. Associated CERT Coding Rules
             1. No CERT Coding Rules corresponding to this CWE entry.
   11. CWE-863: Incorrect Authorization
       1. Mission/Business Risks
       2. Common Attack Pattern Enumeration & Classification
          1. CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
          2. CAPEC-122: Exploitation of Authorization
          3. CAPEC-58: Restful Privilege Elevation
          4. CAPEC-17: Accessing, Modifying or Executing Executable Files
          5. CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
       3. Prevention & Mitigation Practices
          1. Requirements, Architecture & Design
          2. Build, Compilation, Implementation, Testing, and Documentation
          3. Installation, Operation and System Configuration
          4. Associated CERT Coding Rules
             1. No CERT Coding Rules corresponding to this CWE entry.