Krutikp/ComplianceLLM huggingface dataset:
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control (Base)

Description: The product stores sensitive information in a file system or device that does not have built-in access control.

Extended Description: While many modern file systems or devices utilize some form of access control in order to restrict access to data, not all storage mechanisms have this capability. For example, memory cards, floppy disks, CDs, and USB devices are typically made accessible to any user within the system. This can become a problem when sensitive data is stored in these mechanisms in a multi-user environment, because anybody on the system can read or write this data. On Android devices, external storage is typically globally readable and writable by other applications on the device. External storage may also be easily accessible through the mobile device's USB connection or physically accessible through the device's memory card port.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::TECHNOLOGY CLASS:Mobile:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Application Data:IMPACT:Read Files or Directories:NOTE:Attackers can read sensitive information by accessing the unrestricted storage mechanism.::SCOPE:Integrity:IMPACT:Modify Application Data:IMPACT:Modify Files or Directories:NOTE:Attackers can modify or delete sensitive information by accessing the unrestricted storage mechanism.::
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel (Base)

Description: The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.

Extended Description: Attackers might be able to modify the message and spoof the endpoint by interfering with the data as it crosses the network or by redirecting the connection to a system under their control.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Integrity:SCOPE:Confidentiality:IMPACT:Gain Privileges or Assume Identity:NOTE:If an attackers can spoof the endpoint, the attacker gains all the privileges that were intended for the original endpoint.::






Notes: ::TYPE:Maintenance:NOTE:This entry should be made more comprehensive in later CWE versions, as it is likely an important design flaw that underlies (or chains to) other weaknesses.::
CWE-939: Improper Authorization in Handler for Custom URL Scheme (Base)

Description: The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

Extended Description: Mobile platforms and other architectures allow the use of custom URL schemes to facilitate communication between applications. In the case of iOS, this is the only method to do inter-application communication. The implementation is at the developer's discretion which may open security flaws in the application. An example could be potentially dangerous functionality such as modifying files through a custom URL scheme.



Applicable Platforms: ::TECHNOLOGY CLASS:Mobile:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::





Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Utilize a user prompt pop-up to authorize potentially harmful actions such as those modifying data or dealing with sensitive information. When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.::

Observed Examples: ::REFERENCE:CVE-2013-5725:DESCRIPTION:URL scheme has action replace which requires no user prompt and allows remote attackers to perform undesired actions.:LINK:https://www.cve.org/CVERecord?id=CVE-2013-5725::REFERENCE:CVE-2013-5726:DESCRIPTION:URL scheme has action follow and favorite which allows remote attackers to force user to perform undesired actions.:LINK:https://www.cve.org/CVERecord?id=CVE-2013-5726::
CWE-940: Improper Verification of Source of a Communication Channel (Base)

Description: The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

Extended Description: When an attacker can successfully establish a communication channel from an untrusted origin, the attacker may be able to gain privileges and access unexpected functionality.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::TECHNOLOGY CLASS:Mobile:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Access Control:SCOPE:Other:IMPACT:Gain Privileges or Assume Identity:IMPACT:Varies by Context:NOTE:An attacker can access any functionality that is inadvertently accessible to the source.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack. When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.::

Observed Examples: ::REFERENCE:CVE-2000-1218:DESCRIPTION:DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning:LINK:https://www.cve.org/CVERecord?id=CVE-2000-1218::REFERENCE:CVE-2005-0877:DESCRIPTION:DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning:LINK:https://www.cve.org/CVERecord?id=CVE-2005-0877::REFERENCE:CVE-2001-1452:DESCRIPTION:DNS server caches glue records received from non-delegated name servers:LINK:https://www.cve.org/CVERecord?id=CVE-2001-1452::



Notes: ::TYPE:Relationship:NOTE:While many access control issues involve authenticating the user, this weakness is more about authenticating the actual source of the communication channel itself; there might not be any user in such cases.::
CWE-941: Incorrectly Specified Destination in a Communication Channel (Base)

Description: The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

Extended Description: Attackers at the destination may be able to spoof trusted servers to steal data or cause a denial of service. There are at least two distinct weaknesses that can cause the product to communicate with an unintended destination: If the product allows an attacker to control which destination is specified, then the attacker can cause it to connect to an untrusted or malicious destination. For example, because UDP is a connectionless protocol, UDP packets can be spoofed by specifying a false source address in the packet; when the server receives the packet and sends a reply, it will specify a destination by using the source of the incoming packet - i.e., the false source. The server can then be tricked into sending traffic to the wrong host, which is effective for hiding the real source of an attack and for conducting a distributed denial of service (DDoS). As another example, server-side request forgery (SSRF) and XML External Entity (XXE) can be used to trick a server into making outgoing requests to hosts that cannot be directly accessed by the attacker due to firewall restrictions. If the product incorrectly specifies the destination, then an attacker who can control this destination might be able to spoof trusted servers. While the most common occurrence is likely due to misconfiguration by an administrator, this can be resultant from other weaknesses. For example, the product might incorrectly parse an e-mail or IP address and send sensitive data to an unintended destination. As another example, an Android application may use a sticky broadcast to communicate with a receiver for a particular application, but since sticky broadcasts can be processed by *any* receiver, this can allow a malicious application to access restricted data that was only intended for a different application.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::TECHNOLOGY CLASS:Mobile:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::






Observed Examples: ::REFERENCE:CVE-2013-5211:DESCRIPTION:composite: NTP feature generates large responses (high amplification factor) with spoofed UDP source addresses.:LINK:https://www.cve.org/CVERecord?id=CVE-2013-5211::REFERENCE:CVE-1999-0513:DESCRIPTION:Classic Smurf attack, using spoofed ICMP packets to broadcast addresses.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-0513::REFERENCE:CVE-1999-1379:DESCRIPTION:DNS query with spoofed source address causes more traffic to be returned to spoofed address than was sent by the attacker.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-1379::
CWE-1024: Comparison of Incompatible Types (Base)

Description: The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared.

Extended Description: In languages that are strictly typed but support casting/conversion, such as C or C++, the programmer might assume that casting one entity to the same type as another entity will ensure that the comparison will be performed correctly, but this cannot be guaranteed. In languages that are not strictly typed, such as PHP or JavaScript, there may be implicit casting/conversion to a type that the programmer is unaware of, causing unexpected results; for example, the string 123 might be converted to a number type. See examples.



Applicable Platforms: ::LANGUAGE NAME:JavaScript:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:PHP:LANGUAGE PREVALENCE:Undetermined::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Varies by Context::


Potential Mitigations: ::PHASE:Testing:DESCRIPTION:Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.::
CWE-1025: Comparison Using Wrong Factors (Base)

Description: The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

Extended Description: This can lead to incorrect results and resultant weaknesses. For example, the code might inadvertently compare references to objects, instead of the relevant contents of those objects, causing two equal objects to be considered unequal.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Varies by Context::


Potential Mitigations: ::PHASE:Testing:DESCRIPTION:Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.::
CWE-1037: Processor Optimization Removal or Modification of Security-critical Code (Base)

Description: The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Rarely::TECHNOLOGY NAME:Processor Hardware:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:Optimizations built into the design of the processor can have unintended consequences during the execution of an application.::



Common Consequences: ::SCOPE:Integrity:IMPACT:Bypass Protection Mechanism:LIKELIHOOD:High:NOTE:A successful exploitation of this weakness will change the order of an application's execution and will likely be used to bypass specific protection mechanisms. This bypass can be exploited further to potentially read data that should otherwise be unaccessible.::

Detection Methods: ::METHOD:White Box:DESCRIPTION:In theory this weakness can be detected through the use of white box testing techniques where specifically crafted test cases are used in conjunction with debuggers to verify the order of statements being executed.:EFFECTIVENESS:Opportunistic::


Observed Examples: ::REFERENCE:CVE-2017-5715:DESCRIPTION:Intel, ARM, and AMD processor optimizations related to speculative execution and branch prediction cause access control checks to be bypassed when placing data into the cache. Often known as Spectre.:LINK:https://www.cve.org/CVERecord?id=CVE-2017-5715::REFERENCE:CVE-2017-5753:DESCRIPTION:Intel, ARM, and AMD processor optimizations related to speculative execution and branch prediction cause access control checks to be bypassed when placing data into the cache. Often known as Spectre.:LINK:https://www.cve.org/CVERecord?id=CVE-2017-5753::REFERENCE:CVE-2017-5754:DESCRIPTION:Intel processor optimizations related to speculative execution cause access control checks to be bypassed when placing data into the cache. Often known as Meltdown.:LINK:https://www.cve.org/CVERecord?id=CVE-2017-5754::



Notes: ::TYPE:Maintenance:NOTE:As of CWE 4.9, members of the CWE Hardware SIG are closely analyzing this entry and others to improve CWE's coverage of transient execution weaknesses, which include issues related to Spectre, Meltdown, and other attacks. Additional investigation may include other weaknesses related to microarchitectural state. As a result, this entry might change significantly in CWE 4.10.::
CWE-1041: Use of Redundant Code (Base)

Description: The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. For example, if there are two copies of the same code, the programmer might fix a weakness in one copy while forgetting to fix the same weakness in another copy.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::




Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Merge common functionality into a single function and then call that function from across the entire code base.::
CWE-1043: Data Element Aggregating an Excessively Large Number of Non-Primitive Elements (Base)

Description: The product uses a data element that has an excessively large number of sub-elements with non-primitive data types such as structures or aggregated objects.

Extended Description: This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability. While the interpretation of excessively large may vary for each product or developer, CISQ recommends a default of 5 sub-elements.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1044: Architecture with Number of Horizontal Layers Outside of Expected Range (Base)

Description: The product's architecture contains too many - or too few - horizontal layers.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities. While the interpretation of expected range may vary for each product or developer, CISQ recommends a default minimum of 4 layers and maximum of 8 layers.




Modes of Introduction: ::PHASE:Architecture and Design::



Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor (Base)

Description: A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.

Extended Description: This issue can prevent the product from running reliably, since the child might not perform essential destruction operations. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability, such as a memory leak (CWE-401).







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1046: Creation of Immutable Text Using String Concatenation (Base)

Description: The product creates an immutable text string using string concatenation operations.

Extended Description: When building a string via a looping feature (e.g., a FOR or WHILE loop), the use of += to append to the existing string will result in the creation of a new object with each iteration. This programming pattern can be inefficient in comparison with use of text buffer data elements. This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this could be influenced to create performance problem.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1047: Modules with Circular Dependencies (Base)

Description: The product contains modules in which one module has references that cycle back to itself, i.e., there are circular dependencies.

Extended Description: As an example, with Java, this weakness might indicate cycles between packages. This issue makes it more difficult to maintain the product due to insufficient modularity, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities. This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1048: Invokable Control Element with Large Number of Outward Calls (Base)

Description: The code contains callable control elements that contain an excessively large number of references to other application objects external to the context of the callable, i.e. a Fan-Out value that is excessively large.

Extended Description: While the interpretation of excessively large Fan-Out value may vary for each product or developer, CISQ recommends a default of 5 referenced objects. This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1049: Excessive Data Query Operations in a Large Data Table (Base)

Description: The product performs a data query with a large number of joins and sub-queries on a large data table.

Extended Description: This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability. While the interpretation of large data table and large number of joins or sub-queries may vary for each product or developer, CISQ recommends a default of 1 million rows for a large data table, a default minimum of 5 joins, and a default minimum of 3 sub-queries.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1050: Excessive Platform Resource Consumption within a Loop (Base)

Description: The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.

Extended Description: This issue can make the product perform more slowly. If an attacker can influence the number of iterations in the loop, then this performance problem might allow a denial of service by consuming more platform resources than intended.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Performance::
CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data (Base)

Description: The product initializes data using hard-coded values that act as network resource identifiers.

Extended Description: This issue can prevent the product from running reliably, e.g. if it runs in an environment does not use the hard-coded network resource identifiers. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Reliability::
CWE-1052: Excessive Use of Hard-Coded Literals in Initialization (Base)

Description: The product initializes a data element using a hard-coded literal that is not a simple integer or static constant element.

Extended Description: This issue makes it more difficult to modify or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1053: Missing Documentation for Design (Base)

Description: The product does not have documentation that represents how it is designed.

Extended Description: This issue can make it more difficult to understand and maintain the product. It can make it more difficult and time-consuming to detect and/or fix vulnerabilities.
CWE-1054: Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer (Base)

Description: The code at one architectural layer invokes code that resides at a deeper layer than the adjacent layer, i.e., the invocation skips at least one layer, and the invoked code is not part of a vertical utility layer that can be referenced from any horizontal layer.

Extended Description: This issue makes it more difficult to understand and maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::
CWE-1055: Multiple Inheritance from Concrete Classes (Base)

Description: The product contains a class with inheritance from more than one concrete class.

Extended Description: This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.







Common Consequences: ::SCOPE:Other:IMPACT:Reduce Maintainability::