MITRE shares 2024's top 25 most dangerous software weaknesses

MITRE has shared this year's top 25 list of the most common and dangerous software weaknesses behind more than 31,000 vulnerabilities disclosed between June 2023 and June 2024.

Software weaknesses refer to flaws, bugs, vulnerabilities, and errors found in software's code, architecture, implementation, or design.

Attackers can exploit them to breach systems where the vulnerable software is running, enabling them to gain control over affected devices and access sensitive data or trigger denial-of-service attacks.

"Often easy to find and exploit, these can lead to exploitable vulnerabilities that allow adversaries to completely take over a system, steal data, or prevent applications from working," MITRE said today.

"Uncovering the root causes of these vulnerabilities serves as a powerful guide for investments, policies, and practices to prevent these vulnerabilities from occurring in the first place — benefiting both industry and government stakeholders."

To create this year's ranking, MITRE scored each weakness based on its severity and frequency after analyzing 31,770 CVE records for vulnerabilities that "would benefit from re-mapping analysis" and reported across 2023 and 2024, with a focus on security flaws added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

"This annual list identifies the most critical software weaknesses that adversaries frequently exploit to compromise systems, steal sensitive data, or disrupt essential services," CISA added today.

"Organizations are strongly encouraged to review this list and use it to inform their software security strategies. Prioritizing these weaknesses in development and procurement processes helps prevent vulnerabilities at the core of the software lifecycle."

Rank	ID	Name	Score	KEV CVEs	Change
1	CWE-79	Cross-site Scripting	56.92	3	+1
2	CWE-787	Out-of-bounds Write	45.20	18	-1
3	CWE-89	SQL Injection	35.88	4	0
4	CWE-352	Cross-Site Request Forgery (CSRF)	19.57	0	+5
5	CWE-22	Path Traversal	12.74	4	+3
6	CWE-125	Out-of-bounds Read	11.42	3	+1
7	CWE-78	OS Command Injection	11.30	5	-2
8	CWE-416	Use After Free	10.19	5	-4
9	CWE-862	Missing Authorization	10.11	0	+2
10	CWE-434	Unrestricted Upload of File with Dangerous Type	10.03	0	0
11	CWE-94	Code Injection	7.13	7	+12
12	CWE-20	Improper Input Validation	6.78	1	-6
13	CWE-77	Command Injection	6.74	4	+3
14	CWE-287	Improper Authentication	5.94	4	-1
15	CWE-269	Improper Privilege Management	5.22	0	+7
16	CWE-502	Deserialization of Untrusted Data	5.07	5	-1
17	CWE-200	Exposure of Sensitive Information to an Unauthorized Actor	5.07	0	+13
18	CWE-863	Incorrect Authorization	4.05	2	+6
19	CWE-918	Server-Side Request Forgery (SSRF)	4.05	2	0
20	CWE-119	Improper Operations Restriction in Memory Buffer Bounds	3.69	2	-3
21	CWE-476	NULL Pointer Dereference	3.58	0	-9
22	CWE-798	Use of Hard-coded Credentials	3.46	2	-4
23	CWE-190	Integer Overflow or Wraparound	3.37	3	-9
24	CWE-400	Uncontrolled Resource Consumption	3.23	0	+13
25	CWE-306	Missing Authentication for Critical Function	2.73	5	-5

CISA also regularly releases "Secure by Design" alerts highlighting the prevalence of widely known and documented vulnerabilities that have yet to be eliminated from software despite available and effective mitigations.

Some have been issued in response to ongoing malicious activity, like a July alert asking vendors to eliminate path OS command injection vulnerabilities exploited by Chinese Velvet Ant state hackers in recent attacks targeting Cisco, Palo Alto, and Ivanti network edge devices.

In May and March, the cybersecurity agency published two more "Secure by Design" alerts urging tech executives and software developers to prevent path traversal and SQL injection (SQLi) vulnerabilities in their products and code.

CISA also urged tech vendors to stop shipping software and devices with default passwords and small office/home office (SOHO) router manufacturers to secure them against Volt Typhoon attacks.

Last week, the FBI, the NSA, and Five Eyes cybersecurity authorities released a list of the top 15 routinely exploited security vulnerabilities last year, warning that attackers focused on targeting zero-days (security flaws that have been disclosed but are yet to be patched).

"In 2023, the majority of the most frequently exploited vulnerabilities were initially exploited as a zero-day, which is an increase from 2022, when less than half of the top exploited vulnerabilities were exploited as a zero-day," they cautioned.