| CAPEC --> CWE Mappings Added |
|---|
| CAPEC-127 Directory Indexing |
| --> | CWE-276
| |
| --> | CWE-285
| |
| --> | CWE-288
| |
| --> | CWE-424
| |
| --> | CWE-425
| |
| --> | CWE-693
| |
| --> | CWE-721
| |
| --> | CWE-732
| |
| CAPEC-132 Symlink Attack |
| --> | CWE-59
| |
| CAPEC-135 Format String Injection |
| --> | CWE-20
| |
| --> | CWE-74
| |
| --> | CWE-133
| |
| --> | CWE-134
| |
| CAPEC-136 LDAP Injection |
| --> | CWE-20
| |
| --> | CWE-77
| |
| --> | CWE-90
| |
| CAPEC-139 Relative Path Traversal |
| --> | CWE-20
| |
| --> | CWE-22
| |
| CAPEC-141 Cache Poisoning |
| --> | CWE-345
| |
| --> | CWE-346
| |
| --> | CWE-348
| |
| --> | CWE-349
| |
| --> | CWE-441
| |
| CAPEC-142 DNS Cache Poisoning |
| --> | CWE-345
| |
| --> | CWE-346
| |
| --> | CWE-348
| |
| --> | CWE-349
| |
| --> | CWE-350
| |
| --> | CWE-441
| |
| CAPEC-147 XML Ping of the Death |
| --> | CWE-400
| |
| --> | CWE-770
| |
| CAPEC-159 Redirect Access to Libraries |
| --> | CWE-714
| |
| CAPEC-169 Footprinting |
| --> | CWE-200
| |
| --> | CWE-202
| |
| --> | CWE-276
| |
| --> | CWE-311
| |
| --> | CWE-312
| |
| --> | CWE-319
| |
| --> | CWE-497
| |
| --> | CWE-538
| |
| CAPEC-174 Flash Parameter Injection |
| --> | CWE-184 | Incomplete Blacklist |
| --> | CWE-185 | Incorrect Regular Expression |
| --> | CWE-697 | Insufficient Comparison |
| CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels |
| --> | CWE-732
| |
| CAPEC-182 Flash Injection |
| --> | CWE-20 | Improper Input Validation |
| --> | CWE-184 | Incomplete Blacklist |
| --> | CWE-697 | Insufficient Comparison |
| CAPEC-193 PHP Remote File Inclusion |
| --> | CWE-80
| |
| --> | CWE-98
| |
| --> | CWE-714
| |
| CAPEC-196 Session Credential Falsification through Forging |
| --> | CWE-361
| |
| --> | CWE-384
| |
| --> | CWE-664
| |
| CAPEC-197 XEE (XML Entity Expansion) |
| --> | CWE-400
| |
| --> | CWE-770
| |
| CAPEC-199 Cross-Site Scripting Using Alternate Syntax |
| --> | CWE-20
| |
| --> | CWE-71
| |
| --> | CWE-79
| |
| --> | CWE-85
| |
| --> | CWE-86
| |
| --> | CWE-87
| |
| --> | CWE-692
| |
| --> | CWE-697
| |
| --> | CWE-713
| |
| CAPEC-205 Lifting credential(s)/key material embedded in client distributions (thick or thin) |
| --> | CWE-259
| |
| --> | CWE-522
| |
| CAPEC-215 Fuzzing and observing application log data/errors for application mapping |
| --> | CWE-532 | Information Exposure Through Log Files |
| CAPEC-219 XML Routing Detour Attacks |
| --> | CWE-441
| |
| --> | CWE-610
| |
| CAPEC-237 Calling Signed Code From Another Language Within A Sandbox Allow This |
| --> | CWE-693 | Protection Mechanism Failure |
| CAPEC-244 Cross-Site Scripting via Encoded URI Schemes |
| --> | CWE-20
| |
| --> | CWE-71
| |
| --> | CWE-79
| |
| --> | CWE-84
| |
| --> | CWE-85
| |
| --> | CWE-86
| |
| --> | CWE-692
| |
| --> | CWE-697
| |
| --> | CWE-713
| |
| CAPEC-267 Leverage Alternate Encoding |
| --> | CWE-20
| |
| --> | CWE-21
| |
| --> | CWE-73
| |
| --> | CWE-74
| |
| --> | CWE-171
| |
| --> | CWE-172
| |
| --> | CWE-173
| |
| --> | CWE-180
| |
| --> | CWE-181
| |
| --> | CWE-692
| |
| --> | CWE-697
| |
| CAPEC-275 DNS Rebinding |
| --> | CWE-247
| |
| CAPEC-459 Creating a Rogue Certificate Authority Certificate |
| --> | CWE-290 | Authentication Bypass by Spoofing |
| --> | CWE-295 | Certificate Issues |
| --> | CWE-327 | Use of a Broken or Risky Cryptographic Algorithm |
| CAPEC-460 HTTP Parameter Pollution (HPP) |
| --> | CWE-88 | Argument Injection or Modification |
| --> | CWE-147 | Improper Neutralization of Input Terminators |
| --> | CWE-235 | Improper Handling of Extra Parameters |
| CAPEC-461 Web Services API Signature Forgery Leveraging Hash Function Extension Weakness |
| --> | CWE-290 | Authentication Bypass by Spoofing |
| --> | CWE-328 | Reversible One-Way Hash |
| CAPEC-462 Cross-Domain Search Timing |
| --> | CWE-352
| |
| --> | CWE-385
| |
| CAPEC-463 Padding Oracle Crypto Attack |
| --> | CWE-209 | Information Exposure Through an Error Message |
| --> | CWE-347 | Improper Verification of Cryptographic Signature |
| --> | CWE-354 | Improper Validation of Integrity Check Value |
| --> | CWE-514 | Covert Channel |
| --> | CWE-649 | Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking |
| --> | CWE-696 | Incorrect Behavior Order |
| CAPEC-464 Evercookie |
| --> | CWE-359 | Privacy Violation |
| CAPEC-465 Socket Capable Browser Plugins Result In Transparent Proxy Abuse |
| --> | CWE-441 | Unintended Proxy/Intermediary |
| CAPEC-466 Leveraging Active Man in the Middle Attacks to Bypass Single Origin Policy |
| --> | CWE-300 | Channel Accessible by Non-Endpoint ('Man-in-the-Middle') |
| CAPEC-467 Cross Site Identification |
| --> | CWE-352 | Cross-Site Request Forgery (CSRF) |
| --> | CWE-359 | Privacy Violation |
| CAPEC-468 Generic Cross-Browser Cross-Domain Theft |
| --> | CWE-149 | Improper Neutralization of Quoting Syntax |
| --> | CWE-177 | Improper Handling of URL Encoding (Hex Encoding) |
| --> | CWE-707 | Improper Enforcement of Message or Data Structure |
| --> | CWE-838 | Inappropriate Encoding for Output Context |
| CAPEC-469 HTTP DoS |
| --> | CWE-770 | Allocation of Resources Without Limits or Throttling |
| --> | CWE-772 | Missing Release of Resource after Effective Lifetime |
| CAPEC-470 Expanding Control over the Operating System from the Database |
| --> | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
| --> | CWE-250 | Execution with Unnecessary Privileges |
| CAPEC-471 DLL Search Order Hijacking |
| --> | CWE-427 | Uncontrolled Search Path Element |
| --> | CWE-706 | Use of Incorrectly-Resolved Name or Reference |
| CAPEC-472 Browser Fingerprinting |
| --> | CWE-200
| |
