Looking into the mentioned unforgivable vulnerabilities and stubborn weaknesses published by CISA:
Unforgivable Vulnerabilities (PDF)
Given the above criteria, following are some candidates for unforgivable vulnerabilities that satisfy all (or most) of the criteria for an unforgivable vulnerability. […]
- Buffer overflow using long strings of
"A"characters in:- a. Username/password during authentication
- b. File or directory name
- c. Arguments to most common features of the product or product class
- XSS using well-formed
<script>tags, especially in the:- a. Username/password of an authentication routine
- b. Body, subject, title, or to/from of a message
- SQL injection using
'in the:- a. Username/password of an authentication routine
- b.
"id"or other identifier field - c. Numeric field
- Remote file inclusion from direct input such as:
- a.
include($_GET['dir'] . "/config.inc");
- a.
- Directory traversal using
"../.."or"/a/b/c"inGETorSENDcommands of frequently-used file sharing functionality (e.g., aGETin a web/FTP server, or a send-file command in a chat client) - World-writable critical files:
- a. Executables
- b. Libraries
- c. Configuration files
- Direct requests of administrator scripts
- Grow-your-own crypto
- Authentication bypass using
"authenticated=1"cookie/form field - TOCTOU race condition – symlink
- Privilege escalation launching
"help"(Windows) - Hard-coded or undocumented account/password
- Unchecked length/width/height/size values passed to
malloc()/calloc()
Stubborn Weaknesses
| CWE-ID | Description | 2023 Rank | |
|
|
| | CWE-787 | Out-of-bounds Write | 1 | | CWE-79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 2 | | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 3 | | CWE-416 | Use After Free | 4 | | CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 5 | | CWE-20 | Improper Input Validation | 6 | | CWE-125 | Out-of-bounds Read | 7 | | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 8 | | CWE-352 | Cross-Site Request Forgery (CSRF) | 9 | | CWE-476 | NULL Pointer Dereference | 12 | | CWE-287 | Improper Authentication | 13 | | CWE-190 | Integer Overflow or Wraparound | 14 | | CWE-502 | Deserialization of Untrusted Data | 15 | | CWE-119 | Improper Restriction of Operations within Bounds of a Memory Buffer | 17 | | CWE-798 | Use of Hard-coded Credentials | 18 |

What does this nee formulation mean, or is this a typo?