Wiki Home
Software vulnerability (CWE)
Definition
A software vulnerability is a defect in a program that an attacker can exploit to break a security property such as confidentiality, integrity, or availability. Common cases are out-of-bounds memory writes, use-after-free errors, SQL injection, and cross-site scripting, each arising from a recurring coding mistake rather than a one-off slip. The Common Weakness Enumeration (CWE), maintained by MITRE, is a community catalog that assigns each weakness type a stable identifier (CWE-787 for an out-of-bounds write, CWE-89 for SQL injection) and arranges them in a hierarchy, giving tools and papers a shared vocabulary; MITRE also publishes a periodically updated “Top 25” ranking of the most dangerous and prevalent weaknesses. A weakness is concrete when its presence or absence can be decided from the code alone. Detecting the defect, localizing its root cause, and confirming that a patch removes it are separate, progressively harder problems.
Papers that use this concept
- Examining Zero-Shot Vulnerability Repair with Large Language Models — its repair targets are concrete CWEs drawn largely from MITRE’s Top 25, spanning memory-safety, injection, and hardware-description weaknesses.