In the absence of secure software development practises, it’s still a case of “Plus ça change…”:
[…] There were no surprises in this year’s Top 25, agree Buttner and Chris Levendis, MITRE CWE project leader. “A lot of the top weaknesses continue to be in the list, and we continue to see them even as 10 years have passed,” Buttner notes. While weaknesses toward the end of the list have fallen out in favor of new ones, the top weaknesses generally remain the same.
The highest-ranking weakness, with a score of 75.56, is CWE-119, buffer overflow or “Improper Restriction of Operations within the Bounds of a Memory Buffer.” Some languages allow direct addressing of memory locations and don’t automatically ensure locations are valid for the memory buffer being referenced. This can cause read or write operations to be performed on memory locations linked to data structures or internal program data. An attacker could execute malicious code, change the control flow, read sensitive data, or crash the system.