CWE vs CVE

CWE:


The Common Weakness Enumeration (CWE) is a formal list of software weakness types created to Serve as a common language for describing software security weaknesses in architecture, design, or code. 

Reference:

CVE:


CVE is a list of information security vulnerabilities and exposures that aims to provide common names for publicly known problems.

Reference:

Difference (CWE vs CVE):


Software vulnerability is a collection of one or more weaknesses that contain the possible way for an attacker to perform unintended behavior. So a weakness is a patterns or behaviors, a group of weakness or a single weakness may help to perform unintended behavior. In other word, When the weakness can be used by an attacker against the software then that's a vulnerability.

For example, If an address parameter in register page is not properly validated then it contains a Improper/No input validation (CWE:20), if an attacker able to perform SQL injection and gain access to the database then it could be named under CVE.

Comments

Post a Comment

Popular posts from this blog

JTAG PIN Identification