Developer.com content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
The 2010 CWE/SANS list of top 25 most dangerous programming errors is now available. The list was compiled collaboratively by the SANS Institute, MITRE, and other US and European software security experts. The following is an abbreviated version of the list.
- Cross-Site Scripting
- SQL Injection
- Classic Buffer Overflow
- Cross-Site Request Forgery
- Improper Access Control
- Reliance on Untrusted Inputs in a Security Decision
- Path Traversal
- Unrestricted Upload of File with Dangerous Type
- OS Command Injection
- Missing Encryption of Sensitive Data
- Use of Hard-Coded Credentials
- Buffer Access with Incorrect Length Value
- PHP File Inclusion
- Improper Validation of Array Index
- Improper Check for Unusual or Exceptional Conditions
- Information Exposure Through an Error Message
- Integer Overflow or Wraparound
- Incorrect Calculation of Buffer Size
- Missing Authentication for Critical Function
- Download of Code Without Integrity Check
- Incorrect Permission Assignment for Critical Resource
- Allocation of Resources Without Limits or Throttling
- Open Redirect
- Use of a Broken or Risky Cryptographic Algorithm
- Race Condition
