Krutikp/ComplianceLLM huggingface dataset:
CWE-1106: Insufficient Use of Symbolic Constants (Base)

Description: The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1107: Insufficient Isolation of Symbolic Constant Definitions (Base)

Description: The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or isolated location.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1108: Excessive Reliance on Global Variables (Base)

Description: The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::
CWE-1109: Use of Same Variable for Multiple Purposes (Base)

Description: The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.

Extended Description: Use of the same variable for multiple purposes can make it more difficult for a person to read or understand the code, potentially hiding other quality issues. This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1110: Incomplete Design Documentation (Base)

Description: The product's design documentation does not adequately describe control flow, data flow, system initialization, relationships between tasks, components, rationales, or other important aspects of the design.




Applicable Platforms: ::TECHNOLOGY CLASS:Not Technology-Specific:TECHNOLOGY PREVALENCE:Undetermined::TECHNOLOGY CLASS:ICS/OT:TECHNOLOGY PREVALENCE:Undetermined::
CWE-1111: Incomplete I/O Documentation (Base)

Description: The product's documentation does not adequately define inputs, outputs, or system/software interfaces.
CWE-1112: Incomplete Documentation of Program Execution (Base)

Description: The document does not fully define all mechanisms that are used to control or influence how product-specific programs are executed.

Extended Description: This includes environmental variables, configuration files, registry keys, command-line switches or options, or system settings.
CWE-1113: Inappropriate Comment Style (Base)

Description: The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.

Extended Description: This issue makes it more difficult to maintain the product due to insufficient legibility, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.
CWE-1114: Inappropriate Whitespace Style (Base)

Description: The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

Extended Description: This issue makes it more difficult to understand and maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.
CWE-1115: Source Code Element without Standard Prologue (Base)

Description: The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized for the project.

Extended Description: The lack of a prologue can make it more difficult to accurately and quickly understand the associated code. Standard prologues or headers may contain information such as module name, version number, author, date, purpose, function, assumptions, limitations, accuracy considerations, etc. This issue makes it more difficult to maintain the product due to insufficient analyzability, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.
CWE-1116: Inaccurate Comments (Base)

Description: The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.

Extended Description: When a comment does not accurately reflect the associated code elements, this can introduce confusion to a reviewer (due to inconsistencies) or make it more difficult and less efficient to validate that the code is implementing the intended behavior correctly. This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::




Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Verify that each comment accurately reflects what is intended to happen during execution of the code.::
CWE-1117: Callable with Insufficient Behavioral Summary (Base)

Description: The code contains a function or method whose signature and/or associated inline documentation does not sufficiently describe the callable's inputs, outputs, side effects, assumptions, or return codes.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1118: Insufficient Documentation of Error Handling Techniques (Base)

Description: The documentation does not sufficiently describe the techniques that are used for error handling, exception processing, or similar mechanisms.

Extended Description: Documentation may need to cover error handling techniques at multiple layers, such as module, executable, compilable code unit, or callable.
CWE-1119: Excessive Use of Unconditional Branching (Base)

Description: The code uses too many unconditional branches (such as goto).

Extended Description: This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1121: Excessive McCabe Cyclomatic Complexity (Base)

Description: The code contains McCabe cyclomatic complexity that exceeds a desirable maximum.

Extended Description: This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.
CWE-1122: Excessive Halstead Complexity (Base)

Description: The code is structured in a way that a Halstead complexity measure exceeds a desirable maximum.

Extended Description: A variety of Halstead complexity measures exist, such as program vocabulary size or volume. This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1123: Excessive Use of Self-Modifying Code (Base)

Description: The product uses too much self-modifying code.

Extended Description: This issue makes it more difficult to understand or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1124: Excessively Deep Nesting (Base)

Description: The code contains a callable or other code grouping in which the nesting / branching is too deep.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1125: Excessive Attack Surface (Base)

Description: The product has an attack surface whose quantitative measurement exceeds a desirable maximum.

Extended Description: Originating from software security, an attack surface measure typically reflects the number of input points and output points that can be utilized by an untrusted party, i.e. a potential attacker. A larger attack surface provides more places to attack, and more opportunities for developers to introduce weaknesses. In some cases, this measure may reflect other aspects of quality besides security; e.g., a product with many inputs and outputs may require a large number of tests in order to improve code coverage.
CWE-1126: Declaration of Variable with Unnecessarily Wide Scope (Base)

Description: The source code declares a variable in one scope, but the variable is only used within a narrower scope.

Extended Description: This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1127: Compilation with Insufficient Warnings or Errors (Base)

Description: The code is compiled without sufficient warnings enabled, which may prevent the detection of subtle bugs or quality issues.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.




Modes of Introduction: ::PHASE:Build and Compilation::



Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1173: Improper Use of Validation Framework (Base)

Description: The product does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library.

Extended Description: Many modern coding languages provide developers with input validation frameworks to make the task of input validation easier and less error-prone. These frameworks will automatically check all input against specified criteria and direct execution to error handlers when invalid input is received. The improper use (i.e., an incorrect implementation or missing altogether) of these frameworks is not directly exploitable, but can lead to an exploitable condition if proper input validation is not performed later in the product. Not using provided input validation frameworks can also hurt the maintainability of code as future developers may not recognize the downstream input validation being used in the place of the validation framework.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:This weakness may occur when software designers choose to not leverage input validation frameworks provided by the source language.::PHASE:Implementation:NOTE:This weakness may occur when developers do not correctly use a provided input validation framework.::



Common Consequences: ::SCOPE:Integrity:IMPACT:Unexpected State:NOTE:Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Some instances of improper input validation can be detected using automated static analysis. A static analysis tool might allow the user to specify which application-specific methods or functions perform input validation; the tool might also have built-in knowledge of validation frameworks such as Struts. The tool may then suppress or de-prioritize any associated warnings. This allows the analyst to focus on areas of the software in which input validation does not appear to be present. Except in the cases described in the previous paragraph, automated static analysis might not be able to recognize when proper input validation is being performed, leading to false positives - i.e., warnings that do not have any security consequences or require any code changes.::

Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Properly use provided input validation frameworks.::
CWE-1188: Initialization of a Resource with an Insecure Default (Base)

Description: The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

Extended Description: Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value. However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.










Observed Examples: ::REFERENCE:CVE-2022-36349:DESCRIPTION:insecure default variable initialization in BIOS firmware for a hardware board allows DoS:LINK:https://www.cve.org/CVERecord?id=CVE-2022-36349::REFERENCE:CVE-2022-42467:DESCRIPTION:A generic database browser interface has a default mode that exposes a web server to the network, allowing queries to the database.:LINK:https://www.cve.org/CVERecord?id=CVE-2022-42467::



Notes: ::TYPE:Maintenance:NOTE:This entry improves organization of concepts under initialization. The typical CWE model is to cover Missing and Incorrect behaviors. Arguably, this entry could be named as Incorrect instead of Insecure. This might be changed in the near future.::
CWE-1220: Insufficient Granularity of Access Control (Base)

Description: The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Extended Description: Integrated circuits and hardware engines can expose accesses to assets (device configuration, keys, etc.) to trusted firmware or a software module (commonly set by BIOS/bootloader). This access is typically access-controlled. Upon a power reset, the hardware or system usually starts with default values in registers, and the trusted firmware (Boot firmware) configures the necessary access-control protection. A common weakness that can exist in such protection schemes is that access controls or policies are not granular enough. This condition allows agents beyond trusted agents to access assets and could lead to a loss of functionality or the ability to set up the device securely. This further results in security risks from leaked, sensitive, key material to modification of device configuration.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::OPERATING SYSTEM CLASS:Not OS-Specific:OPERATING SYSTEM PREVALENCE:Undetermined::ARCHITECTURE CLASS:Not Architecture-Specific:ARCHITECTURE PREVALENCE:Undetermined::TECHNOLOGY CLASS:Not Technology-Specific:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:Such issues could be introduced during hardware architecture and design and identified later during Testing or System Configuration phases.::PHASE:Implementation:NOTE:Such issues could be introduced during hardware implementation and identified later during Testing or System Configuration phases.::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Integrity:SCOPE:Availability:SCOPE:Access Control:IMPACT:Modify Memory:IMPACT:Read Memory:IMPACT:Execute Unauthorized Code or Commands:IMPACT:Gain Privileges or Assume Identity:IMPACT:Bypass Protection Mechanism:IMPACT:Other:LIKELIHOOD:High::


Potential Mitigations: ::PHASE:Architecture and Design Implementation Testing:DESCRIPTION:Access-control-policy protections must be reviewed for design inconsistency and common weaknesses. Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.:EFFECTIVENESS:High::

Observed Examples: ::REFERENCE:CVE-2022-24985:DESCRIPTION:A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms:LINK:https://www.cve.org/CVERecord?id=CVE-2022-24985::REFERENCE:CVE-2021-36934:DESCRIPTION:An operating system has an overly permission Access Control List onsome system files, including those related to user passwords:LINK:https://www.cve.org/CVERecord?id=CVE-2021-36934::
CWE-1230: Exposure of Sensitive Information Through Metadata (Base)

Description: The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.

Extended Description: Developers might correctly prevent unauthorized access to a database or other resource containing sensitive information, but they might not consider that portions of the original information might also be recorded in metadata, search indices, statistical reports, or other resources. If these resources are not also restricted, then attackers might be able to extract some or all of the original information, or otherwise infer some details. For example, an attacker could specify search terms that are known to be unique to a particular person, or view metadata such as activity or creation dates in order to identify usage patterns.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::OPERATING SYSTEM CLASS:Not OS-Specific:OPERATING SYSTEM PREVALENCE:Undetermined::ARCHITECTURE CLASS:Not Architecture-Specific:ARCHITECTURE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::
CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations (Base)

Description: The code uses boxed primitives, which may introduce inefficiencies into performance-critical operations.

Extended Description: Languages such as Java and C# support automatic conversion through their respective compilers from primitive types into objects of the corresponding wrapper classes, and vice versa. For example, a compiler might convert an int to Integer (called autoboxing) or an Integer to int (called unboxing). This eliminates forcing the programmer to perform these conversions manually, which makes the code cleaner. However, this feature comes at a cost of performance and can lead to resource exhaustion and impact availability when used with generic collections. Therefore, they should not be used for scientific computing or other performance critical operations. They are only suited to support impedance mismatch between reference types and primitives.



Applicable Platforms: ::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C#:LANGUAGE PREVALENCE:Undetermined::OPERATING SYSTEM CLASS:Not OS-Specific:OPERATING SYSTEM PREVALENCE:Undetermined::ARCHITECTURE CLASS:Not Architecture-Specific:ARCHITECTURE PREVALENCE:Undetermined::TECHNOLOGY CLASS:Not Technology-Specific:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:The programmer may use boxed primitives when not strictly necessary.::



Common Consequences: ::SCOPE:Availability:IMPACT:DoS: Resource Consumption (CPU):IMPACT:DoS: Resource Consumption (Memory):IMPACT:DoS: Resource Consumption (Other):IMPACT:Reduce Performance:LIKELIHOOD:Low:NOTE:Incorrect autoboxing/unboxing would result in reduced performance, which sometimes can lead to resource consumption issues.::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Use of boxed primitives should be limited to certain situations such as when calling methods with typed parameters. Examine the use of boxed primitives prior to use. Use SparseArrays or ArrayMap instead of HashMap to avoid performance overhead.::