Quelltext der Seite Top 25 der gefährlichsten Software-Schwachstellen 2022

*[[Die Common Weakness Enumeration (CWE)]]

=Basics=
*Das Common Weakness Enumeration-Projekt hat die Liste für das Jahr 2022 der 25 gefährlichsten Softwareschwachstellen zusammengestellt.
*Die Liste soll die derzeit am meisten vorkommenden Lücken mit den gravierendsten Auswirkungen aufführen. 
*Sie soll helfen Risiken einzudämmen. 
*Sie wendet sich an Softwarearchitekte, Designer, Entwickler, Tester, Nutzer, Projektmanager, Sicherheitsforscher, Ausbilder.
=Schwachstellen=
{| class="wikitable"
|-
! Platz
! ID
! Beschreibung
|-
| 1
| [https://cwe.mitre.org/data/definitions/787.html CWE-787]
| [[Out-of-bounds Write]] ([[Buffer-Overflow]])
|-
| 2
| [https://cwe.mitre.org/data/definitions/79.html CWE-79]
| Improper Neutralization of Input During Web Page Generation ([[Cross-Site-Scripting]])
|-
| 3
| [https://cwe.mitre.org/data/definitions/89.html CWE-89]
| Improper Neutralization of Special Elements used in an SQL Command ([[SQL Injection]])
|-
| 4
| [https://cwe.mitre.org/data/definitions/20.html CWE-20]
| Improper Input Validation ([[Command Execution]])
|-
| 5
| [https://cwe.mitre.org/data/definitions/125.html CWE-125]
| [[Out-of-bounds Read]]
|-
| 6
| [https://cwe.mitre.org/data/definitions/78.html CWE-78]
| Improper Neutralization of Special Elements used in an OS Command ('OS [[Command Execution]]')
|-
| 7
| [https://cwe.mitre.org/data/definitions/416.html CWE-416]
| Use After Free
|-
| 8
| [https://cwe.mitre.org/data/definitions/22.html CWE-22]
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
|-
| 9
| [https://cwe.mitre.org/data/definitions/352.html CWE-352]
| Cross-Site Request Forgery (CSRF)
|-
| 10
| [https://cwe.mitre.org/data/definitions/434.html CWE-434]
| Unrestricted Upload of File with Dangerous Type ([[File Inclusion]])
|-
| 11
| [https://cwe.mitre.org/data/definitions/476.html CWE-476]
| [[NULL Pointer Dereference]]
|-
| 12
| [https://cwe.mitre.org/data/definitions/502.html CWE-502]
| Deserialization of Untrusted Data
|-
| 13
| [https://cwe.mitre.org/data/definitions/190.html CWE-190]
| Integer Overflow or Wraparound
|-
| 14
| [https://cwe.mitre.org/data/definitions/287.html CWE-287]
| [[Improper Authentication]]
|-
| 15
| [https://cwe.mitre.org/data/definitions/798.html CWE-798]
| Use of Hard-coded Credentials
|-
| 16
| [https://cwe.mitre.org/data/definitions/862.html CWE-862]
| [[Missing Authorization]]
|-
| 17
| [https://cwe.mitre.org/data/definitions/77.html CWE-77]
| Improper Neutralization of Special Elements used in a Command ('Command Injection')
|-
| 18
| [https://cwe.mitre.org/data/definitions/306.html CWE-306]
| Missing Authentication for Critical Function
|-
| 19
| [https://cwe.mitre.org/data/definitions/119.html CWE-119]
| Improper Restriction of Operations within the Bounds of a Memory Buffer
|-
| 20
| [https://cwe.mitre.org/data/definitions/276.html CWE-276]
| Incorrect Default Permissions
|-
| 21
| [https://cwe.mitre.org/data/definitions/918.html CWE-918]
| Server-Side Request Forgery (SSRF)
|-
| 22
| [https://cwe.mitre.org/data/definitions/362.html CWE-362]
| Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
|-
| 23
| [https://cwe.mitre.org/data/definitions/400.html CWE-400]
| Uncontrolled Resource Consumption
|-
| 24
| [https://cwe.mitre.org/data/definitions/611.html CWE-611]
| Improper Restriction of XML External Entity Reference
|-
| 25
| [https://cwe.mitre.org/data/definitions/94.html CWE-94]
| Improper Control of Generation of Code ('Code Injection')
|}

=Quellen=
*https://cwe.mitre.org/index.html
*https://www.heise.de/news/Top-25-der-gefaehrlichsten-Software-Schwachstellen-2022-7158261.html