7.<y> Language specific Vulnerabilities for [language] [This section is where vulnerabilities not covered by TR 24772-1 will be placed]. It is possible that there are none for any given language. 8 Implications for standardization [This section provides the opportunity to discuss changes anticipated for future versions of the language specification. The section may be left empty] Index Insufficiently Protected Credentials [XYM], 133 Ada, 13, 59, 63, 73, 76 Memory Locking [XZX], 117 AMV Type-breaking Reinterpretation of Data, 72 Missing or Inconsistent Access Control [XZN], 134 – API Missing Required Cryptographic Step [XZS], 133 Application Programming Interface, 16 Path Traversal [EWR], 130 APL, 48 Privilege Sandbox Issues [XYO], 114 Apple Resource Exhaustion [XZP], 118 OS X, 120 Resource [HTS], 120 application vulnerabilities, 9 Sensitive Information Uncleared Before Use [XZK], 130 Application Vulnerabilities Unquoted Search Path or Element [XZQ], 127 Adherence to Least Privilege [XYN], 113 Unrestricted File Upload [CBF], 119 Authentication Logic Error [XZO], 135 Unspecified Functionality [BVQ], 111 Cross-site Scripting [XYT], 125 URL Redirection to Untrusted Site ('Open Redirect') Discrepancy Information Leak [XZL], 129 [PYQ], 140 Distinguished Values in Data Types [KLK], 112 Use of a One-Way Hash without a Salt [MVX], 141 Download of Code Without Integrity Check [DLB], 137 application vulnerability, 5 Executing or Loading Untrusted Code [XYS], 116 Ariane 5, 21 Hard-coded Password [XYP], 136 Improper Restriction of Excessive Authentication bitwise operators, 48 Attempts [WPL], 140 BJE Incorrect Authorization, 138 – Improperly Verified Signature [XZR], 128 BJL Namespace Issues, 43 – Inclusion of Functionality from Untrusted Control black-list, 120, 124 Sphere [DHU], 139 BQF Unspecified Behaviour, 92, 94, 95 – Incorrect Authorization [BJE], 138 60 break, BRS Obscure Language Features, 91 Injection [RST], 122 –
7.<y> Language specific Vulnerabilities for [language] [This section is where vulnerabilities not covered by TR 24772-1 will be placed]. It is possible that there are none for any given language. 8 Implications for standardization [This section provides the opportunity to discuss changes anticipated for future versions of the language specification. The section may be left empty] Index Ada, 13, 59, 63, 73, 76 AMV – Type-breaking Reinterpretation of Data, 72 API Application Programming Interface, 16 APL, 48 Apple OS X, 120 application vulnerabilities, 9 Application Vulnerabilities Adherence to Least Privilege [XYN], 113 Authentication Logic Error [XZO], 135 Cross-site Scripting [XYT], 125 Discrepancy Information Leak [XZL], 129 Distinguished Values in Data Types [KLK], 112 Download of Code Without Integrity Check [DLB], 137 Executing or Loading Untrusted Code [XYS], 116 Hard-coded Password [XYP], 136 Improper Restriction of Excessive Authentication Attempts [WPL], 140 Improperly Verified Signature [XZR], 128 Inclusion of Functionality from Untrusted Control Sphere [DHU], 139 Incorrect Authorization [BJE], 138 Injection [RST], 122 Insufficiently Protected Credentials [XYM], 133 Memory Locking [XZX], 117 Missing or Inconsistent Access Control [XZN], 134 Missing Required Cryptographic Step [XZS], 133 Path Traversal [EWR], 130 Privilege Sandbox Issues [XYO], 114 Resource Exhaustion [XZP], 118 Resource [HTS], 120 Sensitive Information Uncleared Before Use [XZK], 130 Unquoted Search Path or Element [XZQ], 127 Unrestricted File Upload [CBF], 119 Unspecified Functionality [BVQ], 111 URL Redirection to Untrusted Site ('Open Redirect') [PYQ], 140 Use of a One-Way Hash without a Salt [MVX], 141 application vulnerability, 5 Ariane 5, 21 bitwise operators, 48 BJE – Incorrect Authorization, 138 BJL – Namespace Issues, 43 black-list, 120, 124 BQF – Unspecified Behaviour, 92, 94, 95 break, 60 BRS – Obscure Language Features, 91
ISO-IECJTC1-SC22-WG23_N0548-tr24772-1-draft-edits-after-meeting-35-20150326.docx