| CAPEC --> CWE Mappings Added |
| CAPEC-2 Inducing Account Lockout |
| --> |
CWE-645 |
Overly Restrictive Account Lockout Mechanism |
| CAPEC-4 Using Alternative IP Address Encodings |
| --> |
CWE-173 |
Improper Handling of Alternate Encoding |
| CAPEC-5 Blue Boxing |
| --> |
CWE-285 |
Improper Authorization |
| CAPEC-6 Argument Injection |
| --> |
CWE-74 |
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
| CAPEC-11 Cause Web Server Misclassification |
| --> |
CWE-430 |
Deployment of Wrong Handler |
| CAPEC-23 File Content Injection |
| --> |
CWE-20 |
Improper Input Validation |
| CAPEC-38 Leveraging/Manipulating Configuration File Search Paths |
| --> |
CWE-427 |
Uncontrolled Search Path Element |
| CAPEC-40 Manipulating Writeable Terminal Devices |
| --> |
CWE-77 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') |
| CAPEC-55 Rainbow Table Password Cracking |
| --> |
CWE-916 |
Use of Password Hash With Insufficient Computational Effort |
| CAPEC-117 Interception |
| --> |
CWE-300 |
Channel Accessible by Non-Endpoint ('Man-in-the-Middle') |
| CAPEC-121 Exploit Test APIs |
| --> |
CWE-489 |
Leftover Debug Code |
| CAPEC-122 Privilege Abuse |
| --> |
CWE-269 |
Improper Privilege Management |
| CAPEC-123 Buffer Manipulation |
| --> |
CWE-119 |
Improper Restriction of Operations within the Bounds of a Memory Buffer |
| CAPEC-129 Pointer Manipulation |
| --> |
CWE-822 |
Untrusted Pointer Dereference |
| --> |
CWE-823 |
Use of Out-of-range Pointer Offset |
| CAPEC-133 Try All Common Switches |
| --> |
CWE-912 |
Hidden Functionality |
| CAPEC-134 Email Injection |
| --> |
CWE-150 |
Improper Neutralization of Escape, Meta, or Control Sequences |
| CAPEC-137 Parameter Injection |
| --> |
CWE-88 |
Argument Injection or Modification |
| CAPEC-140 Bypassing of Intermediate Forms in Multiple-Form Sets |
| --> |
CWE-372 |
Incomplete Internal State Distinction |
| CAPEC-145 Checksum Spoofing |
| --> |
CWE-354 |
Improper Validation of Integrity Check Value |
| CAPEC-150 Collect Data from Common Resource Locations |
| --> |
CWE-552 |
Files or Directories Accessible to External Parties |
| CAPEC-153 Input Data Manipulation |
| --> |
CWE-20 |
Improper Input Validation |
| CAPEC-155 Screen Temporary Files for Sensitive Information |
| --> |
CWE-377 |
Insecure Temporary File |
| CAPEC-159 Redirect Access to Libraries |
| --> |
CWE-706 |
Use of Incorrectly-Resolved Name or Reference |
| CAPEC-160 Exploit Script-Based APIs |
| --> |
CWE-346 |
Origin Validation Error |
| CAPEC-166 Force the System to Reset Values |
| --> |
CWE-306 |
Missing Authentication for Critical Function |
| CAPEC-170 Web Application Fingerprinting |
| --> |
CWE-497 |
Exposure of System Data to an Unauthorized Control Sphere |
| CAPEC-174 Flash Parameter Injection |
| --> |
CWE-88 |
Argument Injection or Modification |
| CAPEC-176 Configuration/Environment Manipulation |
| --> |
CWE-15 |
External Control of System or Configuration Setting |
| CAPEC-181 Flash File Overlay |
| --> |
CWE-1021 |
Improper Restriction of Rendered UI Layers or Frames |
| CAPEC-183 IMAP/SMTP Command Injection |
| --> |
CWE-77 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') |
| CAPEC-190 Reverse Engineer an Executable to Expose Assumed Hidden Functionality |
| --> |
CWE-912 |
Hidden Functionality |
| CAPEC-222 iFrame Overlay |
| --> |
CWE-1021 |
Improper Restriction of Rendered UI Layers or Frames |
| CAPEC-226 Session Credential Falsification through Manipulation |
| --> |
CWE-472 |
External Control of Assumed-Immutable Web Parameter |
| --> |
CWE-565 |
Reliance on Cookies without Validation and Integrity Checking |
| CAPEC-228 DTD Injection |
| --> |
CWE-829 |
Inclusion of Functionality from Untrusted Control Sphere |
| CAPEC-233 Privilege Escalation |
| --> |
CWE-269 |
Improper Privilege Management |
| CAPEC-242 Code Injection |
| --> |
CWE-94 |
Improper Control of Generation of Code ('Code Injection') |
| CAPEC-244 XSS Targeting URI Placeholders |
| --> |
CWE-83 |
Improper Neutralization of Script in Attributes in a Web Page |
| CAPEC-251 Local Code Inclusion |
| --> |
CWE-829 |
Inclusion of Functionality from Untrusted Control Sphere |
| CAPEC-252 PHP Local File Inclusion |
| --> |
CWE-829 |
Inclusion of Functionality from Untrusted Control Sphere |
| CAPEC-256 SOAP Array Overflow |
| --> |
CWE-805 |
Buffer Access with Incorrect Length Value |
| CAPEC-261 Fuzzing for garnering other adjacent user/sensitive data |
| --> |
CWE-20 |
Improper Input Validation |
| CAPEC-263 Force Use of Corrupted Files |
| --> |
CWE-829 |
Inclusion of Functionality from Untrusted Control Sphere |
| CAPEC-268 Audit Log Manipulation |
| --> |
CWE-117 |
Improper Output Neutralization for Logs |
| CAPEC-270 Modification of Registry Run Keys |
| --> |
CWE-15 |
External Control of System or Configuration Setting |
| CAPEC-277 Data Interchange Protocol Manipulation |
| --> |
CWE-707 |
Improper Enforcement of Message or Data Structure |
| CAPEC-278 Web Services Protocol Manipulation |
| --> |
CWE-707 |
Improper Enforcement of Message or Data Structure |
| CAPEC-279 SOAP Manipulation |
| --> |
CWE-707 |
Improper Enforcement of Message or Data Structure |
| CAPEC-389 Content Spoofing Via Application API Manipulation |
| --> |
CWE-353 |
Missing Support for Integrity Check |
| CAPEC-402 Bypassing ATA Password Security |
| --> |
CWE-285 |
Improper Authorization |
| CAPEC-474 Signature Spoofing by Key Theft |
| --> |
CWE-522 |
Insufficiently Protected Credentials |
| CAPEC-475 Signature Spoofing by Improper Validation |
| --> |
CWE-327 |
Use of a Broken or Risky Cryptographic Algorithm |
| CAPEC-476 Signature Spoofing by Misrepresentation |
| --> |
CWE-290 |
Authentication Bypass by Spoofing |
| CAPEC-478 Modification of Windows Service Configuration |
| --> |
CWE-284 |
Improper Access Control |
| CAPEC-482 TCP Flood |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-484 XML Client-Side Attack |
| --> |
CWE-91 |
XML Injection (aka Blind XPath Injection) |
| CAPEC-486 UDP Flood |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-487 ICMP Flood |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-488 HTTP Flood |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-489 SSL Flood |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-490 Amplification |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-491 XML Quadratic Expansion |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-492 Regular Expression Exponential Blowup |
| --> |
CWE-400 |
Uncontrolled Resource Consumption ('Resource Exhaustion') |
| CAPEC-493 SOAP Array Blowup |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-494 TCP Fragmentation |
| --> |
CWE-404 |
Improper Resource Shutdown or Release |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-495 UDP Fragmentation |
| --> |
CWE-404 |
Improper Resource Shutdown or Release |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-496 ICMP Fragmentation |
| --> |
CWE-404 |
Improper Resource Shutdown or Release |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-502 Intent Spoof |
| --> |
CWE-284 |
Improper Access Control |
| CAPEC-503 WebView Exposure |
| --> |
CWE-284 |
Improper Access Control |
| CAPEC-504 Task Impersonation |
| --> |
CWE-1021 |
Improper Restriction of Rendered UI Layers or Frames |
| CAPEC-509 Kerberoasting |
| --> |
CWE-552 |
Files or Directories Accessible to External Parties |
| CAPEC-528 XML Flood |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-533 Malicious Manual Software Update |
| --> |
CWE-494 |
Download of Code Without Integrity Check |
| CAPEC-537 Infiltration of Hardware Development Environment |
| --> |
CWE-125 |
Out-of-bounds Read |
| CAPEC-549 Local Execution of Code |
| --> |
CWE-829 |
Inclusion of Functionality from Untrusted Control Sphere |
| CAPEC-550 Install New Service |
| --> |
CWE-284 |
Improper Access Control |
| CAPEC-551 Modify Existing Service |
| --> |
CWE-284 |
Improper Access Control |
| --> |
CWE-522 |
Insufficiently Protected Credentials |
| CAPEC-552 Install Rootkit |
| --> |
CWE-284 |
Improper Access Control |
| CAPEC-554 Functionality Bypass |
| --> |
CWE-424 |
Improper Protection of Alternate Path |
| CAPEC-556 Replace File Extension Handlers |
| --> |
CWE-284 |
Improper Access Control |
| CAPEC-558 Replace Trusted Executable |
| --> |
CWE-284 |
Improper Access Control |
| CAPEC-560 Use of Known Domain Credentials |
| --> |
CWE-522 |
Insufficiently Protected Credentials |
| CAPEC-561 Windows Admin Shares with Stolen Credentials |
| --> |
CWE-522 |
Insufficiently Protected Credentials |
| CAPEC-562 Modify Shared File |
| --> |
CWE-284 |
Improper Access Control |
| CAPEC-563 Add Malicious File to Shared Webroot |
| --> |
CWE-284 |
Improper Access Control |
| CAPEC-564 Run Software at Logon |
| --> |
CWE-284 |
Improper Access Control |
| CAPEC-578 Disable Security Software |
| --> |
CWE-284 |
Improper Access Control |
| CAPEC-588 DOM-Based XSS |
| --> |
CWE-83 |
Improper Neutralization of Script in Attributes in a Web Page |
| CAPEC-589 DNS Blocking |
| --> |
CWE-300 |
Channel Accessible by Non-Endpoint ('Man-in-the-Middle') |
| CAPEC-590 IP Address Blocking |
| --> |
CWE-300 |
Channel Accessible by Non-Endpoint ('Man-in-the-Middle') |
| CAPEC-594 Traffic Injection |
| --> |
CWE-940 |
Improper Verification of Source of a Communication Channel |
| CAPEC-595 Connection Reset |
| --> |
CWE-940 |
Improper Verification of Source of a Communication Channel |
| CAPEC-596 TCP RST Injection |
| --> |
CWE-940 |
Improper Verification of Source of a Communication Channel |
| CAPEC-609 Cellular Traffic Intercept |
| --> |
CWE-311 |
Missing Encryption of Sensitive Data |
| CAPEC-612 WiFi MAC Address Tracking |
| --> |
CWE-300 |
Channel Accessible by Non-Endpoint ('Man-in-the-Middle') |
| CAPEC-613 WiFi SSID Tracking |
| --> |
CWE-300 |
Channel Accessible by Non-Endpoint ('Man-in-the-Middle') |
| CAPEC-615 Evil Twin Wi-Fi Attack |
| --> |
CWE-300 |
Channel Accessible by Non-Endpoint ('Man-in-the-Middle') |
| CAPEC-649 Adding a Space to a File Extension |
| --> |
CWE-46 |
Path Equivalence: 'filename ' (Trailing Space) |
| CAPEC-650 Upload a Web Shell to a Web Server |
| --> |
CWE-287 |
Improper Authentication |
| CAPEC --> CWE Mappings Removed |
| CAPEC-2 Inducing Account Lockout |
| --> |
CWE-400 |
Uncontrolled Resource Consumption ('Resource Exhaustion') |
| CAPEC-4 Using Alternative IP Address Encodings |
| --> |
CWE-41 |
Improper Resolution of Path Equivalence |
| --> |
CWE-180 |
Incorrect Behavior Order: Validate Before Canonicalize |
| --> |
CWE-345 |
Insufficient Verification of Data Authenticity |
| --> |
CWE-697 |
Incorrect Comparison |
| --> |
CWE-707 |
Improper Enforcement of Message or Data Structure |
| CAPEC-5 Blue Boxing |
| --> |
CWE-264 |
Permissions, Privileges, and Access Controls |
| CAPEC-6 Argument Injection |
| --> |
CWE-77 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') |
| CAPEC-11 Cause Web Server Misclassification |
| --> |
CWE-77 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') |
| CAPEC-23 File Content Injection |
| --> |
CWE-22 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| --> |
CWE-23 |
Relative Path Traversal |
| --> |
CWE-77 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') |
| --> |
CWE-713 |
OWASP Top Ten 2007 Category A2 - Injection Flaws |
| --> |
CWE-715 |
OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference |
| CAPEC-40 Manipulating Writeable Terminal Devices |
| --> |
CWE-74 |
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
| --> |
CWE-306 |
Missing Authentication for Critical Function |
| CAPEC-54 Query System for Information |
| --> |
CWE-248 |
Uncaught Exception |
| --> |
CWE-717 |
OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling |
| CAPEC-117 Interception |
| --> |
CWE-200 |
Information Exposure |
| CAPEC-121 Exploit Test APIs |
| --> |
CWE-770 |
Allocation of Resources Without Limits or Throttling |
| CAPEC-122 Privilege Abuse |
| --> |
CWE-434 |
Unrestricted Upload of File with Dangerous Type |
| --> |
CWE-602 |
Client-Side Enforcement of Server-Side Security |
| CAPEC-124 Shared Data Manipulation |
| --> |
CWE-682 |
Incorrect Calculation |
| CAPEC-133 Try All Common Switches |
| --> |
CWE-88 |
Argument Injection or Modification |
| --> |
CWE-559 |
Often Misused: Arguments and Parameters |
| --> |
CWE-656 |
Reliance on Security Through Obscurity |
| CAPEC-155 Screen Temporary Files for Sensitive Information |
| --> |
CWE-311 |
Missing Encryption of Sensitive Data |
| CAPEC-159 Redirect Access to Libraries |
| --> |
CWE-426 |
Untrusted Search Path |
| --> |
CWE-427 |
Uncontrolled Search Path Element |
| --> |
CWE-428 |
Unquoted Search Path or Element |
| CAPEC-174 Flash Parameter Injection |
| --> |
CWE-184 |
Incomplete Blacklist |
| --> |
CWE-185 |
Incorrect Regular Expression |
| --> |
CWE-697 |
Incorrect Comparison |
| CAPEC-190 Reverse Engineer an Executable to Expose Assumed Hidden Functionality or Content |
| --> |
CWE-259 |
Use of Hard-coded Password |
| --> |
CWE-798 |
Use of Hard-coded Credentials |
| CAPEC-191 Read Sensitive Strings Within an Executable |
| --> |
CWE-259 |
Use of Hard-coded Password |
| CAPEC-196 Session Credential Falsification through Forging |
| --> |
CWE-361 |
7PK - Time and State |
| CAPEC-228 DTD Injection |
| --> |
CWE-100 |
DEPRECATED: Technology-Specific Input Validation Problems |
| CAPEC-242 Code Injection |
| --> |
CWE-74 |
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
| CAPEC-244 XSS Targeting URI Placeholders |
| --> |
CWE-84 |
Improper Neutralization of Encoded URI Schemes in a Web Page |
| CAPEC-271 Schema Poisoning |
| --> |
CWE-472 |
External Control of Assumed-Immutable Web Parameter |
| CAPEC-279 SOAP Manipulation |
| --> |
CWE-674 |
Uncontrolled Recursion |
| CAPEC-389 Content Spoofing Via Application API Manipulation |
| --> |
CWE-311 |
Missing Encryption of Sensitive Data |
| --> |
CWE-345 |
Insufficient Verification of Data Authenticity |
| --> |
CWE-346 |
Origin Validation Error |
| --> |
CWE-602 |
Client-Side Enforcement of Server-Side Security |
| CAPEC-474 Signature Spoofing by Key Theft |
| --> |
CWE-216 |
Containment Errors (Container Errors) |
| --> |
CWE-284 |
Improper Access Control |
| --> |
CWE-693 |
Protection Mechanism Failure |
| CAPEC-475 Signature Spoofing by Improper Validation |
| --> |
CWE-693 |
Protection Mechanism Failure |
| CAPEC-478 Modification of Windows Service Configuration |
| --> |
CWE-285 |
Improper Authorization |
| CAPEC-484 XML Client-Side Attack |
| --> |
CWE-19 |
Data Processing Errors |
| CAPEC-578 Disable Security Software |
| --> |
CWE-285 |
Improper Authorization |
| CAPEC-591 Reflected XSS |
| --> |
CWE-20 |
Improper Input Validation |
| CAPEC-592 Stored XSS |
| --> |
CWE-20 |
Improper Input Validation |
| CAPEC-640 Inclusion of Code in Existing Process |
| --> |
CWE-706 |
Use of Incorrectly-Resolved Name or Reference |
| CAPEC-649 Adding a Space to a File Extension |
| --> |
CWE-64 |
Windows Shortcut Following (.LNK) |
