Krutikp/ComplianceLLM huggingface dataset:
CWE-1056: Invokable Control Element with Variadic Parameters (Base)

Description: A named-callable or method control element has a signature that supports a variable (variadic) number of parameters or arguments.

Extended Description: This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability. With variadic arguments, it can be difficult or inefficient for manual analysis to be certain of which function/method is being invoked.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1057: Data Access Operations Outside of Expected Data Manager Component (Base)

Description: The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager.

Extended Description: This issue can make the product perform more slowly than intended, since the intended central data manager may have been explicitly optimized for performance or other quality characteristics. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1058: Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element (Base)

Description: The code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final static storable or member data element.

Extended Description: This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1060: Excessive Number of Inefficient Server-Side Data Accesses (Base)

Description: The product performs too many data queries without using efficient data processing functionality such as stored procedures.

Extended Description: This issue can make the product perform more slowly due to computational expense. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability. While the interpretation of too many data queries may vary for each product or developer, CISQ recommends a default maximum of 5 data queries for an inefficient function/procedure.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1062: Parent Class with References to Child Class (Base)

Description: The code has a parent class that contains references to a child class, its methods, or its members.

Extended Description: This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1063: Creation of Class Instance within a Static Code Block (Base)

Description: A static code block creates an instance of a class.

Extended Description: This pattern identifies situations where a storable data element or member data element is initialized with a value in a block of code which is declared as static. This issue can make the product perform more slowly by performing initialization before it is needed. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1064: Invokable Control Element with Signature Containing an Excessive Number of Parameters (Base)

Description: The product contains a function, subroutine, or method whose signature has an unnecessarily large number of parameters/arguments.

Extended Description: This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities. While the interpretation of large number of parameters. may vary for each product or developer, CISQ recommends a default maximum of 7 parameters/arguments.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1065: Runtime Resource Management Control Element in a Component Built to Run on Application Servers (Base)

Description: The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server.

Extended Description: This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1066: Missing Serialization Control Element (Base)

Description: The product contains a serializable data element that does not have an associated serialization method.

Extended Description: This issue can prevent the product from running reliably, e.g. by triggering an exception. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability. As examples, the serializable nature of a data element comes from a serializable SerializableAttribute attribute in .NET and the inheritance from the java.io.Serializable interface in Java.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1067: Excessive Execution of Sequential Searches of Data Resource (Base)

Description: The product contains a data query against an SQL table or view that is configured in a way that does not utilize an index and may cause sequential searches to be performed.

Extended Description: This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1068: Inconsistency Between Implementation and Documented Design (Base)

Description: The implementation of the product is not consistent with the design as described within the relevant documentation.

Extended Description: This issue makes it more difficult to maintain the product due to inconsistencies, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.



Applicable Platforms: ::TECHNOLOGY CLASS:Not Technology-Specific:TECHNOLOGY PREVALENCE:Undetermined::TECHNOLOGY CLASS:ICS/OT:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::
CWE-1070: Serializable Data Element Containing non-Serializable Item Elements (Base)

Description: The product contains a serializable, storable data element such as a field or member, but the data element contains member elements that are not serializable.

Extended Description: This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability. As examples, the serializable nature of a data element comes from a serializable SerializableAttribute attribute in .NET and the inheritance from the java.io.Serializable interface in Java.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1071: Empty Code Block (Base)

Description: The source code contains a block that does not contain any code, i.e., the block is empty.

Extended Description: Empty code blocks can occur in the bodies of conditionals, function or method definitions, exception handlers, etc. While an empty code block might be intentional, it might also indicate incomplete implementation, accidental code deletion, unexpected macro expansion, etc. For some programming languages and constructs, an empty block might be allowed by the syntax, but the lack of any behavior within the block might violate a convention or API in such a way that it is an error.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1072: Data Resource Access without Use of Connection Pooling (Base)

Description: The product accesses a data resource through a database without using a connection pooling capability.

Extended Description: This issue can make the product perform more slowly, as connection pools allow connections to be reused without the overhead and time consumption of opening and closing a new connection. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses (Base)

Description: The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities.

Extended Description: This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability. While the interpretation of large number of data accesses/queries may vary for each product or developer, CISQ recommends a default maximum of 2 data accesses per function/method.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1074: Class with Excessively Deep Inheritance (Base)

Description: A class has an inheritance level that is too high, i.e., it has a large number of parent classes.

Extended Description: This issue makes it more difficult to understand and maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities. While the interpretation of large number of parent classes may vary for each product or developer, CISQ recommends a default maximum of 7 parent classes.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1075: Unconditional Control Flow Transfer outside of Switch Block (Base)

Description: The product performs unconditional control transfer (such as a goto) in code outside of a branching structure such as a switch block.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1079: Parent Class without Virtual Destructor Method (Base)

Description: A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.

Extended Description: This issue can prevent the product from running reliably due to undefined or unexpected behaviors. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1080: Source Code File with Excessive Number of Lines of Code (Base)

Description: A source code file has too many lines of code.

Extended Description: This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities. While the interpretation of too many lines of code may vary for each product or developer, CISQ recommends a default threshold value of 1000.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1082: Class Instance Self Destruction Control Element (Base)

Description: The code contains a class instance that calls the method or function to delete or destroy itself.

Extended Description: For example, in C++, delete this will cause the object to delete itself. This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1083: Data Access from Outside Expected Data Manager Component (Base)

Description: The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component.

Extended Description: When the product has a data access component, the design may be intended to handle all data access operations through that component. If a data access operation is performed outside of that component, then this may indicate a violation of the intended design. This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1084: Invokable Control Element with Excessive File or Data Access Operations (Base)

Description: A function or method contains too many operations that utilize a data manager or file resource.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities. While the interpretation of too many operations may vary for each product or developer, CISQ recommends a default maximum of 7 operations for the same data manager or file.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code (Base)

Description: A function, method, procedure, etc. contains an excessive amount of code that has been commented out within its body.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities. While the interpretation of excessive volume may vary for each product or developer, CISQ recommends a default threshold of 2% of commented code.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1086: Class with Excessive Number of Child Classes (Base)

Description: A class contains an unnecessarily large number of children.

Extended Description: This issue makes it more difficult to understand and maintain the software, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities. While the interpretation of large number of children may vary for each product or developer, CISQ recommends a default maximum of 10 child classes.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1087: Class with Virtual Method without a Virtual Destructor (Base)

Description: A class contains a virtual method, but the method does not have an associated virtual destructor.

Extended Description: This issue can prevent the product from running reliably, e.g. due to undefined behavior. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1089: Large Data Table with Excessive Number of Indices (Base)

Description: The product uses a large data table that contains an excessively large number of indices.

Extended Description: This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability. While the interpretation of large data table and excessively large number of indices may vary for each product or developer, CISQ recommends a default threshold of 1000000 rows for a large table and a default threshold of 3 indices.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1090: Method Containing Access of a Member Element from Another Class (Base)

Description: A method for a class performs an operation that directly accesses a member element from another class.

Extended Description: This issue suggests poor encapsulation and makes it more difficult to understand and maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1092: Use of Same Invokable Control Element in Multiple Architectural Layers (Base)

Description: The product uses the same control element across multiple architectural layers.

Extended Description: This issue makes it more difficult to understand and maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1094: Excessive Index Range Scan for a Data Resource (Base)

Description: The product contains an index range scan for a large data table, but the scan can cover a large number of rows.

Extended Description: This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability. While the interpretation of large data table and excessive index range may vary for each product or developer, CISQ recommends a threshold of 1000000 table rows and a threshold of 10 for the index range.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1095: Loop Condition Value Update within the Loop (Base)

Description: The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.

Extended Description: This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1097: Persistent Storable Data Element without Associated Comparison Control Element (Base)

Description: The product uses a storable data element that does not have all of the associated functions or methods that are necessary to support comparison.

Extended Description: For example, with Java, a class that is made persistent requires both hashCode() and equals() methods to be defined. This issue can prevent the product from running reliably, due to incorrect or unexpected comparison results. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element (Base)

Description: The code contains a data element with a pointer that does not have an associated copy or constructor method.

Extended Description: This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1099: Inconsistent Naming Conventions for Identifiers (Base)

Description: The product's code, documentation, or other artifacts do not consistently use the same naming conventions for variables, callables, groups of related callables, I/O capabilities, data types, file names, or similar types of elements.

Extended Description: This issue makes it more difficult to understand and/or maintain the product due to inconsistencies, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.
CWE-1100: Insufficient Isolation of System-Dependent Functions (Base)

Description: The product or code does not isolate system-dependent functionality into separate standalone modules.

Extended Description: This issue makes it more difficult to maintain and/or port the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1101: Reliance on Runtime Component in Generated Code (Base)

Description: The product uses automatically-generated code that cannot be executed without a specific runtime support component.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1102: Reliance on Machine-Dependent Data Representation (Base)

Description: The code uses a data representation that relies on low-level data representation or constructs that may vary across different processors, physical machines, OSes, or other physical components.

Extended Description: This issue makes it more difficult to maintain and/or port the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1103: Use of Platform-Dependent Third Party Components (Base)

Description: The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1104: Use of Unmaintained Third Party Components (Base)

Description: The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

Extended Description: Reliance on components that are no longer maintained can make it difficult or impossible to fix significant bugs, vulnerabilities, or quality issues. In effect, unmaintained code can become obsolete. This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.



Applicable Platforms: ::TECHNOLOGY CLASS:Not Technology-Specific:TECHNOLOGY PREVALENCE:Undetermined::TECHNOLOGY CLASS:ICS/OT:TECHNOLOGY PREVALENCE:Undetermined::




Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1105: Insufficient Encapsulation of Machine-Dependent Functionality (Base)

Description: The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the rest of the code.

Extended Description: This issue makes it more difficult to port or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::