97 Things Every Information Security Professional Should Know

Chapter 74. CWE Top 25 Most Dangerous Software Weaknesses

Rushi Purohit

Common Weakness Enumeration (CWE™) is a community-developed list of common software and hardware weaknesses that have quality and security ramifications. “Weaknesses” are flaws, faults, bugs, or other errors in software or hardware implementation, code, design, or architecture that if left unaddressed could result in systems, networks, or hardware being vulnerable to attack. CWE serves as a common language, a measuring stick for security tools, and a baseline for weakness identification, mitigation, and prevention efforts.

Targeted at both the development and security practitioner communities, the main goal of CWE is to educate software and hardware architects, designers, programmers, etc., on how to eliminate the most common mistakes as early in the software development life cycle (SDLC) as possible. Ultimately, use of CWE helps prevent the kinds of security vulnerabilities that have plagued the software and hardware industries and place enterprises at risk. This, in return, helps save money in the long run as well as reduce liability that occurs through these flaws.

With over 900 weaknesses in the CWE corpus, the CWE Team helps the community prioritize the list via the annual Top 25 Most Dangerous Software Weaknesses list (CWE Top 25). It is a demonstrative, data-driven list of the most common and impactful ...