These programming errors include improper input validation, improper encoding or escaping of output, failure to preserve SQL query structure (SQL injection), and failure to preserve Web page structure (cross-site scripting). These are among the worst of the worst in the list of the Top 25, published Monday by MITRE Corp. and The SANS Institute, participants in what's called the Common Weakness Enumeration (CWE) project organized by the U.S. Department of Homeland Security's National Cybersecurity Division.

"It's been a three-year project to collect all the things that can go wrong in software architecture, design or code," says Bob Martin, CWE project leader at MITRE, known for its role in federal research projects.

After more than 700 types of problems were identified for CWE inclusion last year, MITRE and SANS asked experts in security organizations, firms and academia to help narrow the list down to the 25 worst. The goal was not only to get industry to focus on the worst software mistakes but also to provide a common vocabulary to address them with training and tools.

Several tools vendors, including Breach Security, Fortify Software, Veracode, Ounce Labs, and Core Security Technologies, are backing the Top 25 and CWE categorization. "This is the first serious attempt at building a taxonomy of software security weaknesses and flaws with an emphasis on practical application of identifying, preventing and fixing or mitigating the issues they pose," said Ivan Arce, CTO at Core Security Technologies in a prepared statement.

In all, about thirty firms and organizations have voiced basic consensus around the Top 25. These supporters include vendors, such as Microsoft, Apple, Red Hat and Oracle; security firms McAfee, Symantec and EMC; the National Security Agency and U.S. Department of Energy; organizations such as the Computer Emergency Response Team and the Open Web Application Security Project; plus academic institutions Purdue University, Kentucky University and the University of California at Davis.

SANS director of research Alan Paller anticipates the impact of the Top 25 list will go beyond simply providing a foundation for better software training and tools or speaking in a common language about software weaknesses. It is likely to work its way into software contract negotiations as well as testing of programmers, he says.