From 7fdede5646d18ec9808d72a62082a8fdf97012e8 Mon Sep 17 00:00:00 2001 From: Helge Wehder Date: Tue, 5 Nov 2024 16:29:12 +0000 Subject: [PATCH] pySCG: adding missing CVEs to CWE 180, 501, 502, 843 Signed-off-by: Helge Wehder --- docs/Secure-Coding-Guide-for-Python/readme.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/Secure-Coding-Guide-for-Python/readme.md b/docs/Secure-Coding-Guide-for-Python/readme.md index f216bcb3..8da1a544 100644 --- a/docs/Secure-Coding-Guide-for-Python/readme.md +++ b/docs/Secure-Coding-Guide-for-Python/readme.md @@ -47,13 +47,13 @@ It is **not production code** and requires code-style or python best practices t |[CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)](CWE-664/CWE-409/.)|| |[CWE-410: Insufficient Resource Pool](CWE-664/CWE-410/README.md)|| |[CWE-426: Untrusted Search Path](CWE-664/CWE-426/README.md)|[CVE-2015-1326](https://www.cvedetails.com/cve/CVE-2015-1326),
CVSSv3.0: **8.8**,
EPSS: **00.20** (23.11.2023)| -|[CWE-501: Trust Boundary Violation)](CWE-664/CWE-501/README.md)|| -|[CWE-502: Deserialization of Untrusted Data)](CWE-664/CWE-502/.)|| +|[CWE-501: Trust Boundary Violation)](CWE-664/CWE-501/README.md)|[CVE-2023-28597](https://www.cvedetails.com/cve/CVE-2023-28597),
CVSSv3.0: **7.5**,
EPSS: **00.11** (05.11.2024)| +|[CWE-502: Deserialization of Untrusted Data)](CWE-664/CWE-502/.)|[CVE-2018-8021](https://www.cvedetails.com/cve/CVE-2018-8021),
CVSSv3.0: **9.8**,
EPSS: **93.54** (05.11.2024)| |[CWE-532: Insertion of Sensitive Information into Log File](CWE-664/CWE-532/.)|| |[CWE-665: Improper Initialization](CWE-664/CWE-665/README.md)|| |[CWE-681: Incorrect Conversion between Numeric Types](CWE-664/CWE-681/README.md)|| |[CWE-833: Deadlock](CWE-664/CWE-833/README.md)|| -|[CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')](CWE-664/CWE-843/.)|| +|[CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')](CWE-664/CWE-843/.)|[CVE-2021-29513](https://www.cvedetails.com/cve/CVE-2021-29513),
CVSSv3.1: **7.8**,
EPSS: **00.05** (05.11.2024)| |[XXX-005: Consider hash-based integrity verification of byte code files against their source code files](CWE-664/XXX-005/.)|| |[CWE-682: Incorrect Calculation](https://cwe.mitre.org/data/definitions/682.html)|Prominent CVE| @@ -88,7 +88,7 @@ It is **not production code** and requires code-style or python best practices t |:----------------------------------------------------------------|:----| |[CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')](CWE-707/CWE-89/.)|[CVE-2019-8600](https://www.cvedetails.com/cve/CVE-2019-8600/),
CVSSv3.1: **9.8**,
EPSS: **01.43** (18.02.2024)| |[CWE-117: Improper Output Neutralization for Logs](CWE-707/CWE-117/.)|| -|[CWE-180: Incorrect behavior order: Validate before Canonicalize](CWE-707/CWE-180/.)|| +|[CWE-180: Incorrect behavior order: Validate before Canonicalize](CWE-707/CWE-180/.)|[CVE-2022-26136](https://www.cvedetails.com/cve/CVE-2022-26136/),
CVSSv3.1: **9.8**,
EPSS: **00.77** (05.11.2024)| |[CWE-710: Improper Adherence to Coding Standards](https://cwe.mitre.org/data/definitions/710.html)|Prominent CVE| |:----------------------------------------------------------------|:----|