DHS, Mitre Name SQL Injection Flaws As Most Dangerous Software Error

Top 25 list also cites OS command errors, buffer overflow vulns at top of list

Vulnerabilities that leave applications open to SQL injection are the most dangerous software errors in cyberspace, according to rankings issued earlier this week by top security groups.
Issued by the Department of Homeland Security, Mitre, and the SANS Institute, the
2011 CWE/SANS Top 25 Most Dangerous Software Errors
is a list of the most widespread and critical errors that can lead to serious vulnerabilities in software.
They are often easy to find, and easy to exploit, the groups say. They are dangerous because they will frequently allow attackers to completely take over the software, steal data, or prevent the software from working at all.
The Top 25 list is an extension of a list that has been issued in the past by Mitre and the SANS Institute to help programmers to prevent the kinds of vulnerabilities that often lead to application breaches -- data on more than 800 programming errors, design errors, and architecture errors that can lead to exploitable vulnerabilities. The list was selected from more than 800 errors recorded in Mitres Common Weakness Enumeration (CWE) database.
This years Top 25 entries are prioritized using inputs from more than 20 different organizations, which evaluated each weakness based on prevalence, importance, and likelihood of exploit. It uses the Common Weakness Scoring System (CWSS) to score and rank the final results.
Operating-system command injection finished second on the most dangerous list, followed by buffer overflow and cross-site scripting.
One purpose of the list is to give weight to specific flaws, in hopes of driving programmers to avoid them, says Alan Paller, director of the SANS Institute. It helps to show that some errors have a high value and some have low value, Paller says. You cant give a programmer a list of 860 things that need to be fixed and expect them to respond. Theyll throw the list away. You need to give them some weight.
Application security experts say the list helps raise consciousness on specific types of errors, but they wonder how much impact it will likely have on software developers.
Everyone seems to be focusing on the fact that SQL injection made it to No. 1 this year, but I find myself thinking, So what? says Vinnie Liu, a founder of the consulting firm Stach & Liu, which offers application assessment and testing services. SQL injection was the vulnerability behind the Sony, Infraguard, and other recent attacks. Yet no matter if it’s No. 1, No. 4, or No. 10, it always has been one of the primary causes of significant data breaches in the past, and it will continue to be for many years to come.
Have a comment on this story? Please click Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
DHS, Mitre Name SQL Injection Flaws As Most Dangerous Software Error