25 ضعف نرم افزاری بزرگ سال 2024 به گزارش MITRE

1

CWE-79

Cross-site Scripting

56.92

3

+1

2

CWE-787

Out-of-bounds Write

45.20

18

-1

3

CWE-89

SQL Injection

35.88

4

0

4

CWE-352

Cross-Site Request Forgery (CSRF)

19.57

0

+5

5

CWE-22

Path Traversal

12.74

4

+3

6

CWE-125

Out-of-bounds Read

11.42

3

+1

7

CWE-78

OS Command Injection

11.30

5

-2

8

CWE-416

Use After Free

10.19

5

-4

9

CWE-862

Missing Authorization

10.11

0

+2

10

CWE-434

Unrestricted Upload of File with Dangerous Type

10.03

0

0

11

CWE-94

Code Injection

7.13

7

+12

12

CWE-20

Improper Input Validation

6.78

1

-6

13

CWE-77

Command Injection

6.74

4

+3

14

CWE-287

Improper Authentication

5.94

4

-1

15

CWE-269

Improper Privilege Management

5.22

0

+7

16

CWE-502

Deserialization of Untrusted Data

5.07

5

-1

17

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

5.07

0

+13

18

CWE-863

Incorrect Authorization

4.05

2

+6

19

CWE-918

Server-Side Request Forgery (SSRF)

4.05

2

0

20

CWE-119

Improper Operations Restriction in Memory Buffer Bounds

3.69

2

-3

21

CWE-476

NULL Pointer Dereference

3.58

0

-9

22

CWE-798

Use of Hard-coded Credentials

3.46

2

-4

23

CWE-190

Integer Overflow or Wraparound

3.37

3

-9

24

CWE-400

Uncontrolled Resource Consumption

3.23

0

+13

25

CWE-306

Missing Authentication for Critical Function

2.73

5

-5