Krutikp/ComplianceLLM huggingface dataset:
CWE-439: Behavioral Change in New Version or Environment (Base)

Description: A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.



Alternate Terms: ::TERM:Functional change::

Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Quality Degradation:IMPACT:Varies by Context::



Observed Examples: ::REFERENCE:CVE-2002-1976:DESCRIPTION:Linux kernel 2.2 and above allow promiscuous mode using a different method than previous versions, and ifconfig is not aware of the new method (alternate path property).:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1976::REFERENCE:CVE-2005-1711:DESCRIPTION:Product uses defunct method from another product that does not return an error code and allows detection avoidance.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1711::REFERENCE:CVE-2003-0411:DESCRIPTION:chain: Code was ported from a case-sensitive Unix platform to a case-insensitive Windows platform where filetype handlers treat .jsp and .JSP as different extensions. JSP source code may be read because .JSP defaults to the filetype text.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0411::
CWE-440: Expected Behavior Violation (Base)

Description: A feature, API, or function does not perform according to its specification.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::TECHNOLOGY CLASS:ICS/OT:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::PHASE:Operation::



Common Consequences: ::SCOPE:Other:IMPACT:Quality Degradation:IMPACT:Varies by Context::



Observed Examples: ::REFERENCE:CVE-2003-0187:DESCRIPTION:Program uses large timeouts on unconfirmed connections resulting from inconsistency in linked lists implementations.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0187::REFERENCE:CVE-2003-0465:DESCRIPTION:strncpy in Linux kernel acts different than libc on x86, leading to expected behavior difference - sort of a multiple interpretation error?:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0465::REFERENCE:CVE-2005-3265:DESCRIPTION:Buffer overflow in product stems the use of a third party library function that is expected to have internal protection against overflows, but doesn't.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-3265::



Notes: ::TYPE:Theoretical:NOTE:The behavior of an application that is not consistent with the expectations of the developer may lead to incorrect use of the software.::
CWE-447: Unimplemented or Unsupported Feature in UI (Base)

Description: A UI function for a security feature appears to be supported and gives feedback to the user that suggests that it is supported, but the underlying functionality is not implemented.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Varies by Context::


Potential Mitigations: ::PHASE:Testing:DESCRIPTION:Perform functionality testing before deploying the application.::

Observed Examples: ::REFERENCE:CVE-2000-0127:DESCRIPTION:GUI configuration tool does not enable a security option when a checkbox is selected, although that option is honored when manually set in the configuration file.:LINK:https://www.cve.org/CVERecord?id=CVE-2000-0127::REFERENCE:CVE-2001-0863:DESCRIPTION:Router does not implement a specific keyword when it is used in an ACL, allowing filter bypass.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0863::REFERENCE:CVE-2001-0865:DESCRIPTION:Router does not implement a specific keyword when it is used in an ACL, allowing filter bypass.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0865::REFERENCE:CVE-2004-0979:DESCRIPTION:Web browser does not properly modify security setting when the user sets it.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-0979::



Notes: ::TYPE:Research Gap:NOTE:This issue needs more study, as there are not many examples. It is not clear whether it is primary or resultant.::
CWE-448: Obsolete Feature in UI (Base)

Description: A UI function is obsolete and the product does not warn the user.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Quality Degradation:IMPACT:Varies by Context::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Remove the obsolete feature from the UI. Warn the user that the feature is no longer supported.::
CWE-449: The UI Performs the Wrong Action (Base)

Description: The UI performs the wrong action with respect to the user's request.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Quality Degradation:IMPACT:Varies by Context::


Potential Mitigations: ::PHASE:Testing:DESCRIPTION:Perform extensive functionality testing of the UI. The UI should behave as specified.::

Observed Examples: ::REFERENCE:CVE-2001-1387:DESCRIPTION:Network firewall accidentally implements one command line option as if it were another, possibly leading to behavioral infoleak.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-1387::REFERENCE:CVE-2001-0081:DESCRIPTION:Command line option correctly suppresses a user prompt but does not properly disable a feature, although when the product prompts the user, the feature is properly disabled.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0081::REFERENCE:CVE-2002-1977:DESCRIPTION:Product does not time out according to user specification, leaving sensitive data available after it has expired.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1977::
CWE-454: External Initialization of Trusted Variables or Data Stores (Base)

Description: The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.

Extended Description: A product system should be reluctant to trust variables that have been initialized outside of its trust boundary, especially if they are initialized by users. The variables may have been initialized incorrectly. If an attacker can initialize the variable, then they can influence what the vulnerable system will do.



Applicable Platforms: ::LANGUAGE NAME:PHP:LANGUAGE PREVALENCE:Sometimes::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:IMPACT:Modify Application Data:NOTE:An attacker could gain access to and modify sensitive data or system information.::


Potential Mitigations: ::PHASE:Implementation:STRATEGY:Input Validation:DESCRIPTION:A product system should be reluctant to trust variables that have been initialized outside of its trust boundary. Ensure adequate checking (e.g. input validation) is performed when relying on input from outside a trust boundary.::PHASE:Architecture and Design:DESCRIPTION:Avoid any external control of variables. If necessary, restrict the variables that can be modified using an allowlist, and use a different namespace or naming convention if possible.::

Observed Examples: ::REFERENCE:CVE-2022-43468:DESCRIPTION:WordPress module sets internal variables based on external inputs, allowing false reporting of the number of views:LINK:https://www.cve.org/CVERecord?id=CVE-2022-43468::REFERENCE:CVE-2000-0959:DESCRIPTION:Does not clear dangerous environment variables, enabling symlink attack.:LINK:https://www.cve.org/CVERecord?id=CVE-2000-0959::REFERENCE:CVE-2001-0033:DESCRIPTION:Specify alternate configuration directory in environment variable, enabling untrusted path.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0033::REFERENCE:CVE-2001-0872:DESCRIPTION:Dangerous environment variable not cleansed.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0872::REFERENCE:CVE-2001-0084:DESCRIPTION:Specify arbitrary modules using environment variable.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0084::



Notes: ::TYPE:Relationship:NOTE:Overlaps Missing variable initialization, especially in PHP.::TYPE:Applicable Platform:NOTE:This is often found in PHP due to register_globals and the common practice of storing library/include files under the web document root so that they are available using a direct request.::
CWE-455: Non-exit on Failed Initialization (Base)

Description: The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Modify Application Data:IMPACT:Alter Execution Logic:NOTE:The application could be placed in an insecure state that may allow an attacker to modify sensitive data or allow unintended logic to be executed.::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Follow the principle of failing securely when an error occurs. The system should enter a state where it is not vulnerable and will not display sensitive error messages to a potential attacker.::

Observed Examples: ::REFERENCE:CVE-2005-1345:DESCRIPTION:Product does not trigger a fatal error if missing or invalid ACLs are in a configuration file.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1345::



Notes: ::TYPE:Research Gap:NOTE:Under-studied. These issues are not frequently reported, and it is difficult to find published examples.::
CWE-463: Deletion of Data Structure Sentinel (Base)

Description: The accidental deletion of a data-structure sentinel can cause serious programming logic problems.

Extended Description: Often times data-structure sentinels are used to mark structure of the data structure. A common example of this is the null character at the end of strings. Another common example is linked lists which may contain a sentinel to mark the end of the list. It is dangerous to allow this type of control data to be easily accessible. Therefore, it is important to protect from the deletion or modification outside of some wrapper interface which provides safety.



Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Availability:SCOPE:Other:IMPACT:Other:NOTE:Generally this error will cause the data structure to not work properly.::SCOPE:Authorization:SCOPE:Other:IMPACT:Other:NOTE:If a control character, such as NULL is removed, one may cause resource access control problems.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Use an abstraction library to abstract away risky APIs. Not a complete solution.::PHASE:Build and Compilation:STRATEGY:Compilation or Build Hardening:DESCRIPTION:Run or compile the software using features or extensions that automatically provide a protection mechanism that mitigates or eliminates buffer overflows. For example, certain compilers and extensions provide automatic buffer overflow detection mechanisms that are built into the compiled code. Examples include the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice.:EFFECTIVENESS:Defense in Depth::PHASE:Operation:DESCRIPTION:Use OS-level preventative functionality. Not a complete solution.::
CWE-464: Addition of Data Structure Sentinel (Base)

Description: The accidental addition of a data-structure sentinel can cause serious programming logic problems.

Extended Description: Data-structure sentinels are often used to mark the structure of data. A common example of this is the null character at the end of strings or a special sentinel to mark the end of a linked list. It is dangerous to allow this type of control data to be easily accessible. Therefore, it is important to protect from the addition or modification of sentinels.



Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:IMPACT:Modify Application Data:NOTE:Generally this error will cause the data structure to not work properly by truncating the data.::


Potential Mitigations: ::PHASE:Implementation Architecture and Design:DESCRIPTION:Encapsulate the user from interacting with data sentinels. Validate user input to verify that sentinels are not present.::PHASE:Implementation:DESCRIPTION:Proper error checking can reduce the risk of inadvertently introducing sentinel values into data. For example, if a parsing function fails or encounters an error, it might return a value that is the same as the sentinel.::PHASE:Architecture and Design:DESCRIPTION:Use an abstraction library to abstract away risky APIs. This is not a complete solution.::PHASE:Operation:DESCRIPTION:Use OS-level preventative functionality. This is not a complete solution.::
CWE-466: Return of Pointer Value Outside of Expected Range (Base)

Description: A function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference.




Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Integrity:IMPACT:Read Memory:IMPACT:Modify Memory::






Notes: ::TYPE:Maintenance:NOTE:This entry should have a chaining relationship with CWE-119 instead of a parent / child relationship, however the focus of this weakness does not map cleanly to any existing entries in CWE. A new parent is being considered which covers the more generic problem of incorrect return values. There is also an abstract relationship to weaknesses in which one component sends incorrect messages to another component; in this case, one routine is sending an incorrect value to another.::
CWE-468: Incorrect Pointer Scaling (Base)

Description: In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.




Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:Programmers may try to index from a pointer by adding a number of bytes. This is incorrect because C and C++ implicitly scale the operand by the size of the data type.::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Integrity:IMPACT:Read Memory:IMPACT:Modify Memory:NOTE:Incorrect pointer scaling will often result in buffer overflow conditions. Confidentiality can be compromised if the weakness is in the context of a buffer over-read or under-read.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Use a platform with high-level memory abstractions.::PHASE:Implementation:DESCRIPTION:Always use array indexing instead of direct pointer manipulation.::PHASE:Architecture and Design:DESCRIPTION:Use technologies for preventing buffer overflows.::
CWE-469: Use of Pointer Subtraction to Determine Size (Base)

Description: The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.




Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Access Control:SCOPE:Integrity:SCOPE:Confidentiality:SCOPE:Availability:IMPACT:Modify Memory:IMPACT:Read Memory:IMPACT:Execute Unauthorized Code or Commands:IMPACT:Gain Privileges or Assume Identity:NOTE:There is the potential for arbitrary code execution with privileges of the vulnerable program.::

Detection Methods: ::METHOD:Fuzzing:DESCRIPTION:Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.:EFFECTIVENESS:High::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Save an index variable. This is the recommended solution. Rather than subtract pointers from one another, use an index variable of the same size as the pointers in question. Use this variable to walk from one pointer to the other and calculate the difference. Always validate this number.::
CWE-474: Use of Function with Inconsistent Implementations (Base)

Description: The code uses a function that has inconsistent implementations across operating systems and versions.

Extended Description: The use of inconsistent implementations can cause changes in behavior when the code is ported or built under a different environment than the programmer expects, which can lead to security problems in some cases. The implementation of many functions varies by platform, and at times, even by different versions of the same platform. Implementation differences can include: Slight differences in the way parameters are interpreted leading to inconsistent results. Some implementations of the function carry significant security risks. The function might not be defined on all platforms. The function might change which return codes it can provide, or change the meaning of its return codes.



Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Often::LANGUAGE NAME:PHP:LANGUAGE PREVALENCE:Often::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Quality Degradation:IMPACT:Varies by Context::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Architecture and Design Requirements:DESCRIPTION:Do not accept inconsistent behavior from the API specifications when the deviant behavior increase the risk level.::
CWE-475: Undefined Behavior for Input to API (Base)

Description: The behavior of this function is undefined unless its control parameter is set to a specific value.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Quality Degradation:IMPACT:Varies by Context::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::





Notes: ::TYPE:Other:NOTE:The Linux Standard Base Specification 2.0.1 for libc places constraints on the arguments to some internal functions [21]. If the constraints are not met, the behavior of the functions is not defined. It is unusual for this function to be called directly. It is almost always invoked through a macro defined in a system header file, and the macro ensures that the following constraints are met: The value 1 must be passed to the third parameter (the version number) of the following file system function: __xmknod The value 2 must be passed to the third parameter (the group argument) of the following wide character string functions: __wcstod_internal __wcstof_internal __wcstol_internal __wcstold_internal __wcstoul_internal The value 3 must be passed as the first parameter (the version number) of the following file system functions: __xstat __lxstat __fxstat __xstat64 __lxstat64 __fxstat64::