Krutikp/ComplianceLLM huggingface dataset:
CWE-571: Expression is Always True (Base)

Description: The product contains an expression that will always evaluate to true.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Quality Degradation:IMPACT:Varies by Context::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Testing:DESCRIPTION:Use Static Analysis tools to spot such conditions.::
CWE-580: clone() Method Without super.clone() (Variant)

Description: The product contains a clone() method that does not call super.clone() to obtain the new object.

Extended Description: All implementations of clone() should obtain the new object by calling super.clone(). If a class does not follow this convention, a subclass's clone() method will return an object of the wrong type.



Applicable Platforms: ::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Unexpected State:IMPACT:Quality Degradation::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Call super.clone() within your clone() method, when obtaining a new object.::PHASE:Implementation:DESCRIPTION:In some cases, you can eliminate the clone method altogether and use copy constructors.::
CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined (Variant)

Description: The product does not maintain equal hashcodes for equal objects.

Extended Description: Java objects are expected to obey a number of invariants related to equality. One of these invariants is that equal objects must have equal hashcodes. In other words, if a.equals(b) == true then a.hashCode() == b.hashCode().



Applicable Platforms: ::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Other:NOTE:If this invariant is not upheld, it is likely to cause trouble if objects of this class are stored in a collection. If the objects of the class in question are used as a key in a Hashtable or if they are inserted into a Map or Set, it is critical that equal objects have equal hashcodes.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Both Equals() and Hashcode() should be defined.::
CWE-584: Return Inside Finally Block (Base)

Description: The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.





Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Alter Execution Logic::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Do not use a return statement inside the finally block. The finally block should have cleanup code.::
CWE-586: Explicit Call to Finalize() (Base)

Description: The product makes an explicit call to the finalize() method from outside the finalizer.

Extended Description: While the Java Language Specification allows an object's finalize() method to be called from outside the finalizer, doing so is usually a bad idea. For example, calling finalize() explicitly means that finalize() will be called more than once: the first time will be the explicit call and the last time will be the call that is made after the object is garbage collected.



Applicable Platforms: ::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Unexpected State:IMPACT:Quality Degradation::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation Testing:DESCRIPTION:Do not make explicit calls to finalize(). Use static analysis tools to spot such instances.::
CWE-587: Assignment of a Fixed Address to a Pointer (Variant)

Description: The product sets a pointer to a specific address other than NULL or 0.

Extended Description: Using a fixed address is not portable, because that address will probably not be valid in all environments or platforms.



Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C#:LANGUAGE PREVALENCE:Undetermined::LANGUAGE CLASS:Assembly:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Confidentiality:SCOPE:Availability:IMPACT:Execute Unauthorized Code or Commands:NOTE:If one executes code at a known location, an attacker might be able to inject code there beforehand.::SCOPE:Availability:IMPACT:DoS: Crash, Exit, or Restart:IMPACT:Reduce Maintainability:IMPACT:Reduce Reliability:NOTE:If the code is ported to another platform or environment, the pointer is likely to be invalid and cause a crash.::SCOPE:Confidentiality:SCOPE:Integrity:IMPACT:Read Memory:IMPACT:Modify Memory:NOTE:The data at a known pointer location can be easily read or influenced by an attacker.::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Never set a pointer to a fixed address.::
CWE-603: Use of Client-Side Authentication (Base)

Description: A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

Extended Description: Client-side authentication is extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::TECHNOLOGY CLASS:ICS/OT:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.::PHASE:Implementation::



Common Consequences: ::SCOPE:Access Control:IMPACT:Bypass Protection Mechanism:IMPACT:Gain Privileges or Assume Identity::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Do not rely on client side data. Always perform server side authentication.::

Observed Examples: ::REFERENCE:CVE-2022-33139:DESCRIPTION:SCADA system only uses client-side authentication, allowing adversaries to impersonate other users.:LINK:https://www.cve.org/CVERecord?id=CVE-2022-33139::REFERENCE:CVE-2006-0230:DESCRIPTION:Client-side check for a password allows access to a server using crafted XML requests from a modified client.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-0230::
CWE-605: Multiple Binds to the Same Port (Variant)

Description: When multiple sockets are allowed to bind to the same port, other services on that port may be stolen or spoofed.

Extended Description: On most systems, a combination of setting the SO_REUSEADDR socket option, and a call to bind() allows any process to bind to a port to which a previous process has bound with INADDR_ANY. This allows a user to bind to the specific address of a server bound to INADDR_ANY on an unprivileged port, and steal its UDP packets/TCP connection.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::PHASE:Operation::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Integrity:IMPACT:Read Application Data:NOTE:Packets from a variety of network services may be stolen or the services spoofed.::


Potential Mitigations: ::PHASE:Policy:DESCRIPTION:Restrict server socket address to known local addresses.::
CWE-606: Unchecked Input for Loop Condition (Base)

Description: The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.





Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Availability:IMPACT:DoS: Resource Consumption (CPU)::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Do not use user-controlled data for loop conditions.::PHASE:Implementation:DESCRIPTION:Perform input validation.::
CWE-609: Double-Checked Locking (Base)

Description: The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.

Extended Description: Double-checked locking refers to the situation where a programmer checks to see if a resource has been initialized, grabs a lock, checks again to see if the resource has been initialized, and then performs the initialization if it has not occurred yet. This should not be done, as it is not guaranteed to work in all languages and on all architectures. In summary, other threads may not be operating inside the synchronous block and are not guaranteed to see the operations execute in the same order as they would appear inside the synchronous block.



Applicable Platforms: ::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Modify Application Data:IMPACT:Alter Execution Logic::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:While double-checked locking can be achieved in some languages, it is inherently flawed in Java before 1.5, and cannot be achieved without compromising platform independence. Before Java 1.5, only use of the synchronized keyword is known to work. Beginning in Java 1.5, use of the volatile keyword allows double-checked locking to work successfully, although there is some debate as to whether it achieves sufficient performance gains. See references.::
CWE-613: Insufficient Session Expiration (Base)

Description: According to WASC, Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.





Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Access Control:IMPACT:Bypass Protection Mechanism::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Set sessions/credentials expiration date.::




Notes: ::TYPE:Other:NOTE:The lack of proper session expiration may improve the likely success of certain attacks. For example, an attacker may intercept a session ID, possibly via a network sniffer or Cross-site Scripting attack. Although short session expiration times do not help if a stolen token is immediately used, they will protect against ongoing replaying of the session ID. In another scenario, a user might access a web site from a shared computer (such as at a library, Internet cafe, or open work environment). Insufficient Session Expiration could allow an attacker to use the browser's back button to access web pages previously accessed by the victim.::
CWE-618: Exposed Unsafe ActiveX Method (Variant)

Description: An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain).

Extended Description: ActiveX controls can exercise far greater control over the operating system than typical Java or javascript. Exposed methods can be subject to various vulnerabilities, depending on the implemented behaviors of those methods, and whether input validation is performed on the provided arguments. If there is no integrity checking or origin validation, this method could be invoked by attackers.




Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Other::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:If you must expose a method, make sure to perform input validation on all arguments, and protect against all possible vulnerabilities.::PHASE:Architecture and Design:DESCRIPTION:Use code signing, although this does not protect against any weaknesses that are already in the control.::PHASE:Architecture and Design System Configuration:DESCRIPTION:Where possible, avoid marking the control as safe for scripting.::

Observed Examples: ::REFERENCE:CVE-2007-1120:DESCRIPTION:download a file to arbitrary folders.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-1120::REFERENCE:CVE-2006-6838:DESCRIPTION:control downloads and executes a url in a parameter:LINK:https://www.cve.org/CVERecord?id=CVE-2006-6838::REFERENCE:CVE-2007-0321:DESCRIPTION:resultant buffer overflow:LINK:https://www.cve.org/CVERecord?id=CVE-2007-0321::
CWE-619: Dangling Database Cursor ('Cursor Injection') (Base)

Description: If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor dangling.

Extended Description: For example, an improper dangling cursor could arise from unhandled exceptions. The impact of the issue depends on the cursor's role, but SQL injection attacks are commonly possible.

Background Details: ::A cursor is a feature in Oracle PL/SQL and other languages that provides a handle for executing and accessing the results of SQL queries.::


Applicable Platforms: ::LANGUAGE NAME:SQL:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:This issue is currently reported for unhandled exceptions, but it is theoretically possible any time the programmer does not close the cursor at the proper time.::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Integrity:IMPACT:Read Application Data:IMPACT:Modify Application Data::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Close cursors immediately after access to them is complete. Ensure that you close cursors if exceptions occur.::
CWE-620: Unverified Password Change (Base)

Description: When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Extended Description: This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Access Control:IMPACT:Bypass Protection Mechanism:IMPACT:Gain Privileges or Assume Identity::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:When prompting for a password change, force the user to provide the original password in addition to the new password.::PHASE:Architecture and Design:DESCRIPTION:Do not use forgotten password functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.::

Observed Examples: ::REFERENCE:CVE-2007-0681:DESCRIPTION:Web app allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-0681::REFERENCE:CVE-2000-0944:DESCRIPTION:Web application password change utility doesn't check the original password.:LINK:https://www.cve.org/CVERecord?id=CVE-2000-0944::
CWE-624: Executable Regular Expression Error (Base)

Description: The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

Extended Description: Case (2) is possible in the PHP preg_replace() function, and possibly in other languages when a user-controlled input is inserted into a string that is later parsed as a regular expression.



Applicable Platforms: ::LANGUAGE NAME:PHP:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Perl:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Integrity:SCOPE:Availability:IMPACT:Execute Unauthorized Code or Commands::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:The regular expression feature in some languages allows inputs to be quoted or escaped before insertion, such as Q and E in Perl.::

Observed Examples: ::REFERENCE:CVE-2006-2059:DESCRIPTION:Executable regexp in PHP by inserting e modifier into first argument to preg_replace:LINK:https://www.cve.org/CVERecord?id=CVE-2006-2059::REFERENCE:CVE-2005-3420:DESCRIPTION:Executable regexp in PHP by inserting e modifier into first argument to preg_replace:LINK:https://www.cve.org/CVERecord?id=CVE-2005-3420::REFERENCE:CVE-2006-2878:DESCRIPTION:Complex curly syntax inserted into the replacement argument to PHP preg_replace(), which uses the /e modifier:LINK:https://www.cve.org/CVERecord?id=CVE-2006-2878::REFERENCE:CVE-2006-2908:DESCRIPTION:Function allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace function call with a /e (executable) modifier.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-2908::



Notes: ::TYPE:Research Gap:NOTE:Under-studied. The existing PHP reports are limited to highly skilled researchers, but there are few examples for other languages. It is suspected that this is under-reported for all languages. Usability factors might make it more prevalent in PHP, but this theory has not been investigated.::
CWE-628: Function Call with Incorrectly Specified Arguments (Base)

Description: The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

Extended Description: There are multiple ways in which this weakness can be introduced, including: the wrong variable or reference; an incorrect number of arguments; incorrect order of arguments; wrong type of arguments; or wrong value.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:SCOPE:Access Control:IMPACT:Quality Degradation:IMPACT:Gain Privileges or Assume Identity:NOTE:This weakness can cause unintended behavior and can lead to additional weaknesses such as allowing an attacker to gain unintended access to system resources.::

Detection Methods: ::METHOD:Other:DESCRIPTION:Since these bugs typically introduce incorrect behavior that is obvious to users, they are found quickly, unless they occur in rarely-tested code paths. Managing the correct number of arguments can be made more difficult in cases where format strings are used, or when variable numbers of arguments are supported.::

Potential Mitigations: ::PHASE:Build and Compilation:DESCRIPTION:Once found, these issues are easy to fix. Use code inspection tools and relevant compiler features to identify potential violations. Pay special attention to code that is not likely to be exercised heavily during QA.::PHASE:Architecture and Design:DESCRIPTION:Make sure your API's are stable before you use them in production code.::

Observed Examples: ::REFERENCE:CVE-2006-7049:DESCRIPTION:The method calls the functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-7049::