Pour obtenir une clé
d'essai remplissez le formulaire ci-dessous
Demandez des tariffs
Nouvelle licence
Renouvellement de licence
--Sélectionnez la devise--
USD
EUR
RUB
* En cliquant sur ce bouton, vous acceptez notre politique de confidentialité

Free PVS-Studio license for Microsoft MVP specialists
To get the licence for your open-source project, please fill out this form
** En cliquant sur ce bouton, vous acceptez notre politique de confidentialité.

I am interested to try it on the platforms:
** En cliquant sur ce bouton, vous acceptez notre politique de confidentialité.

Votre message a été envoyé.

Nous vous répondrons à


Si vous n'avez toujours pas reçu de réponse, vérifiez votre dossier
Spam/Junk et cliquez sur le bouton "Not Spam".
De cette façon, vous ne manquerez la réponse de notre équipe.

>
>
>
Common Weakness Enumeration (CWE)

Common Weakness Enumeration (CWE)

15 Jul 2021

Common Weakness Enumeration (CWE) is a community-developed list of security weaknesses. CWE is used as a common language to describe (and, therefore, to prevent) software and hardware weaknesses. Security weaknesses are flaws and errors in software or hardware implementation, design, architecture, etc., that might lead to vulnerabilities exploited by attackers.

The main goal of CWE is to prevent vulnerabilities by educating software developers how to avoid the most common errors. That is, CWE allows programmers to eliminate software and hardware vulnerabilities.

CWE helps to:

  • describe and discuss software and hardware weaknesses in a common language;
  • check for security flaws in existing software and hardware;
  • evaluate the capabilities of tools targeting security weaknesses;
  • prevent software and hardware vulnerabilities prior to deployment.

Various static code analyzers can be used to detect the errors listed in the CWE. PVS-Studio is one of such tools. See also the classification of PVS-Studio warnings according to the Common Weakness Enumeration.

It's wrong to say that analyzers issue warnings for code fragments containing vulnerabilities. Not every error classified according to the CWE is a vulnerability. Most software errors cannot be used for malicious purposes. Therefore, it's better to say that static analyzers detect potential vulnerabilities.

Comments (0)

Next comments
Unicorn with delicious cookie
Nous utilisons des cookies pour améliorer votre expérience de navigation. En savoir plus
Accepter