Krutikp/ComplianceLLM huggingface dataset:
CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference (Base)

Description: Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.

Extended Description: Programmers typically catch NullPointerException under three circumstances: The program contains a null pointer dereference. Catching the resulting exception was easier than fixing the underlying problem. The program explicitly throws a NullPointerException to signal an error condition. The code is part of a test harness that supplies unexpected input to the classes under test. Of these three circumstances, only the last is acceptable.



Applicable Platforms: ::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Availability:IMPACT:DoS: Resource Consumption (CPU)::

Detection Methods: ::METHOD:Automated Static Analysis - Binary or Bytecode:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis:EFFECTIVENESS:SOAR Partial::METHOD:Dynamic Analysis with Manual Results Interpretation:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Framework-based Fuzzer:EFFECTIVENESS:SOAR Partial::METHOD:Manual Static Analysis - Source Code:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Manual Source Code Review (not inspections):EFFECTIVENESS:SOAR Partial::METHOD:Automated Static Analysis - Source Code:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer:EFFECTIVENESS:High::METHOD:Architecture or Design Review:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Architecture and Design Implementation:DESCRIPTION:Do not extensively rely on catching exceptions (especially for validating user input) to handle errors. Handling exceptions can decrease the performance of an application.::
CWE-396: Declaration of Catch for Generic Exception (Base)

Description: Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

Extended Description: Multiple catch blocks can get ugly and repetitive, but condensing catch blocks by catching a high-level class like Exception can obscure exceptions that deserve special treatment or that should not be caught at this point in the program. Catching an overly broad exception essentially defeats the purpose of a language's typed exceptions, and can become particularly dangerous if the program grows and begins to throw new types of exceptions. The new exception types will not receive any attention.



Applicable Platforms: ::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C#:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Python:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Non-Repudiation:SCOPE:Other:IMPACT:Hide Activities:IMPACT:Alter Execution Logic::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::
CWE-397: Declaration of Throws for Generic Exception (Base)

Description: Throwing overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

Extended Description: Declaring a method to throw Exception or Throwable makes it difficult for callers to perform proper error handling and error recovery. Java's exception mechanism, for example, is set up to make it easy for callers to anticipate what can go wrong and write code to handle each specific exceptional circumstance. Declaring that a method throws a generic form of exception defeats this system.



Applicable Platforms: ::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C#:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Non-Repudiation:SCOPE:Other:IMPACT:Hide Activities:IMPACT:Alter Execution Logic::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::





Notes: ::TYPE:Applicable Platform:NOTE:For C++, this weakness only applies to C++98, C++03, and C++11. It relies on a feature known as Dynamic Exception Specification, which was part of early versions of C++ but was deprecated in C++11. It has been removed for C++17 and later.::
CWE-403: Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') (Base)

Description: A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.

Extended Description: When a new process is forked or executed, the child process inherits any open file descriptors. When the child process has fewer privileges than the parent process, this might introduce a vulnerability if the child process can access the file descriptor but does not have the privileges to access the associated file.


Alternate Terms: ::TERM:File descriptor leak:DESCRIPTION:While this issue is frequently called a file descriptor leak, the leak term is often used in two different ways - exposure of a resource, or consumption of a resource. Use of this term could cause confusion.::

Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::OPERATING SYSTEM CLASS:Unix:OPERATING SYSTEM PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Integrity:IMPACT:Read Application Data:IMPACT:Modify Application Data::



Observed Examples: ::REFERENCE:CVE-2003-0740:DESCRIPTION:Server leaks a privileged file descriptor, allowing the server to be hijacked.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0740::REFERENCE:CVE-2004-1033:DESCRIPTION:File descriptor leak allows read of restricted files.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-1033::REFERENCE:CVE-2000-0094:DESCRIPTION:Access to restricted resource using modified file descriptor for stderr.:LINK:https://www.cve.org/CVERecord?id=CVE-2000-0094::REFERENCE:CVE-2002-0638:DESCRIPTION:Open file descriptor used as alternate channel in complex race condition.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0638::REFERENCE:CVE-2003-0489:DESCRIPTION:Program does not fully drop privileges after creating a file descriptor, which allows access to the descriptor via a separate vulnerability.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0489::REFERENCE:CVE-2003-0937:DESCRIPTION:User bypasses restrictions by obtaining a file descriptor then calling setuid program, which does not close the descriptor.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0937::REFERENCE:CVE-2004-2215:DESCRIPTION:Terminal manager does not properly close file descriptors, allowing attackers to access terminals of other users.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-2215::REFERENCE:CVE-2006-5397:DESCRIPTION:Module opens a file for reading twice, allowing attackers to read files.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-5397::


Affected Resources: ::System Process::File or Directory::
CWE-408: Incorrect Behavior Order: Early Amplification (Base)

Description: The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Availability:IMPACT:DoS: Amplification:IMPACT:DoS: Crash, Exit, or Restart:IMPACT:DoS: Resource Consumption (CPU):IMPACT:DoS: Resource Consumption (Memory):NOTE:System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.::



Observed Examples: ::REFERENCE:CVE-2004-2458:DESCRIPTION:Tool creates directories before authenticating user.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-2458::



Notes: ::TYPE:Relationship:NOTE:Overlaps authentication errors.::
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) (Base)

Description: The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Extended Description: An example of data amplification is a decompression bomb, a small ZIP file that can produce a large amount of data when it is decompressed.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Availability:IMPACT:DoS: Amplification:IMPACT:DoS: Crash, Exit, or Restart:IMPACT:DoS: Resource Consumption (CPU):IMPACT:DoS: Resource Consumption (Memory):NOTE:System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.::



Observed Examples: ::REFERENCE:CVE-2009-1955:DESCRIPTION:XML bomb in web server module:LINK:https://www.cve.org/CVERecord?id=CVE-2009-1955::REFERENCE:CVE-2003-1564:DESCRIPTION:Parsing library allows XML bomb:LINK:https://www.cve.org/CVERecord?id=CVE-2003-1564::
CWE-410: Insufficient Resource Pool (Base)

Description: The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

Extended Description: Frequently the consequence is a flood of connection or sessions.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::PHASE:Operation::



Common Consequences: ::SCOPE:Availability:SCOPE:Integrity:SCOPE:Other:IMPACT:DoS: Crash, Exit, or Restart:IMPACT:Other:NOTE:Floods often cause a crash or other problem besides denial of the resource itself; these are likely examples of *other* vulnerabilities, not an insufficient resource pool.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.::PHASE:Architecture and Design:DESCRIPTION:Consider implementing a velocity check mechanism which would detect abusive behavior.::PHASE:Operation:DESCRIPTION:Consider load balancing as an option to handle heavy loads.::PHASE:Implementation:DESCRIPTION:Make sure that resource handles are properly closed when no longer needed.::PHASE:Architecture and Design:DESCRIPTION:Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).::

Observed Examples: ::REFERENCE:CVE-1999-1363:DESCRIPTION:Large number of locks on file exhausts the pool and causes crash.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-1363::REFERENCE:CVE-2001-1340:DESCRIPTION:Product supports only one connection and does not disconnect a user who does not provide credentials.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-1340::REFERENCE:CVE-2002-0406:DESCRIPTION:Large number of connections without providing credentials allows connection exhaustion.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0406::
CWE-413: Improper Resource Locking (Base)

Description: The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.

Extended Description: When a resource is not properly locked, an attacker could modify the resource while it is being operated on by the product. This might violate the product's assumption that the resource will not change, potentially leading to unexpected behaviors.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Availability:IMPACT:Modify Application Data:IMPACT:DoS: Instability:IMPACT:DoS: Crash, Exit, or Restart::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Use a non-conflicting privilege scheme.::PHASE:Architecture and Design Implementation:DESCRIPTION:Use synchronization when locking a resource.::

Observed Examples: ::REFERENCE:CVE-2022-20141:DESCRIPTION:Chain: an operating system kernel has insufficent resource locking (CWE-413) leading to a use after free (CWE-416).:LINK:https://www.cve.org/CVERecord?id=CVE-2022-20141::
CWE-414: Missing Lock Check (Base)

Description: A product does not check to see if a lock is present before performing sensitive operations on a resource.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Availability:IMPACT:Modify Application Data:IMPACT:DoS: Instability:IMPACT:DoS: Crash, Exit, or Restart::


Potential Mitigations: ::PHASE:Architecture and Design Implementation:DESCRIPTION:Implement a reliable lock mechanism.::

Observed Examples: ::REFERENCE:CVE-2004-1056:DESCRIPTION:Product does not properly check if a lock is present, allowing other attackers to access functionality.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-1056::
CWE-419: Unprotected Primary Channel (Base)

Description: The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.::PHASE:Implementation::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:IMPACT:Bypass Protection Mechanism::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Do not expose administrative functionnality on the user UI.::PHASE:Architecture and Design:DESCRIPTION:Protect the administrative/restricted functionality with a strong authentication mechanism.::
CWE-420: Unprotected Alternate Channel (Base)

Description: The product protects a primary channel, but it does not use the same level of protection for an alternate channel.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.::PHASE:Implementation::PHASE:Operation::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:IMPACT:Bypass Protection Mechanism::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.::

Observed Examples: ::REFERENCE:CVE-2020-8004:DESCRIPTION:When the internal flash is protected by blocking access on the Data Bus (DBUS), it can still be indirectly accessed through the Instruction Bus (IBUS).:LINK:https://www.cve.org/CVERecord?id=CVE-2020-8004::REFERENCE:CVE-2002-0567:DESCRIPTION:DB server assumes that local clients have performed authentication, allowing attacker to directly connect to a process to load libraries and execute commands; a socket interface also exists (another alternate channel), so attack can be remote.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0567::REFERENCE:CVE-2002-1578:DESCRIPTION:Product does not restrict access to underlying database, so attacker can bypass restrictions by directly querying the database.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1578::REFERENCE:CVE-2003-1035:DESCRIPTION:User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-1035::REFERENCE:CVE-2002-1863:DESCRIPTION:FTP service can not be disabled even when other access controls would require it.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1863::REFERENCE:CVE-2002-0066:DESCRIPTION:Windows named pipe created without authentication/access control, allowing configuration modification.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0066::REFERENCE:CVE-2004-1461:DESCRIPTION:Router management interface spawns a separate TCP connection after authentication, allowing hijacking by attacker coming from the same IP address.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-1461::



Notes: ::TYPE:Relationship:NOTE:This can be primary to authentication errors, and resultant from unhandled error conditions.::
CWE-421: Race Condition During Access to Alternate Channel (Base)

Description: The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors.

Extended Description: This creates a race condition that allows an attacker to access the channel before the authorized user does.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:IMPACT:Bypass Protection Mechanism::



Observed Examples: ::REFERENCE:CVE-1999-0351:DESCRIPTION:FTP Pizza Thief vulnerability. Attacker can connect to a port that was intended for use by another client.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-0351::REFERENCE:CVE-2003-0230:DESCRIPTION:Product creates Windows named pipe during authentication that another attacker can hijack by connecting to it.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0230::


Affected Resources: ::System Process::
CWE-430: Deployment of Wrong Handler (Base)

Description: The wrong handler is assigned to process an object.

Extended Description: An example of deploying the wrong handler would be calling a servlet to reveal source code of a .JSP file, or automatically determining type of the object even if it is contradictory to an explicitly specified type.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Varies by Context:IMPACT:Unexpected State::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Perform a type check before interpreting an object.::PHASE:Architecture and Design:DESCRIPTION:Reject any inconsistent types, such as a file with a .GIF extension that appears to consist of PHP code.::

Observed Examples: ::REFERENCE:CVE-2001-0004:DESCRIPTION:Source code disclosure via manipulated file extension that causes parsing by wrong DLL.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0004::REFERENCE:CVE-2002-0025:DESCRIPTION:Web browser does not properly handle the Content-Type header field, causing a different application to process the document.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0025::REFERENCE:CVE-2000-1052:DESCRIPTION:Source code disclosure by directly invoking a servlet.:LINK:https://www.cve.org/CVERecord?id=CVE-2000-1052::REFERENCE:CVE-2002-1742:DESCRIPTION:Arbitrary Perl functions can be loaded by calling a non-existent function that activates a handler.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1742::
CWE-431: Missing Handler (Base)

Description: A handler is not available or implemented.

Extended Description: When an exception is thrown and not caught, the process has given up an opportunity to decide if a given failure or event is worth a change in execution.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Varies by Context::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Handle all possible situations (e.g. error condition).::PHASE:Implementation:DESCRIPTION:If an operation can throw an Exception, implement a handler for that specific exception.::

Observed Examples: ::REFERENCE:CVE-2022-25302:DESCRIPTION:SDK for OPC Unified Architecture (OPC UA) is missing a handler for when a cast fails, allowing for a crash:LINK:https://www.cve.org/CVERecord?id=CVE-2022-25302::
CWE-437: Incomplete Model of Endpoint Features (Base)

Description: A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Unexpected State:IMPACT:Varies by Context::






Notes: ::TYPE:Relationship:NOTE:This can be related to interaction errors, although in some cases, one of the endpoints is not performing correctly according to specification.::