Krutikp/ComplianceLLM huggingface dataset:
CWE-191: Integer Underflow (Wrap or Wraparound) (Base)

Description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Extended Description: This can happen in signed and unsigned cases.


Alternate Terms: ::TERM:Integer underflow:DESCRIPTION:Integer underflow is sometimes used to identify signedness errors in which an originally positive number becomes negative as a result of subtraction. However, there are cases of bad subtraction in which unsigned integers are involved, so it's not always a signedness issue. Integer underflow is occasionally used to describe array index errors in which the index is negative.::

Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C#:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Availability:IMPACT:DoS: Crash, Exit, or Restart:IMPACT:DoS: Resource Consumption (CPU):IMPACT:DoS: Resource Consumption (Memory):IMPACT:DoS: Instability:NOTE:This weakness will generally lead to undefined behavior and therefore crashes. In the case of overflows involving loop index variables, the likelihood of infinite loops is also high.::SCOPE:Integrity:IMPACT:Modify Memory:NOTE:If the value in question is important to data (as opposed to flow), simple data corruption has occurred. Also, if the wrap around results in other conditions such as buffer overflows, further memory corruption may occur.::SCOPE:Confidentiality:SCOPE:Availability:SCOPE:Access Control:IMPACT:Execute Unauthorized Code or Commands:IMPACT:Bypass Protection Mechanism:NOTE:This weakness can sometimes trigger buffer overflows which can be used to execute arbitrary code. This is usually outside the scope of a program's implicit security policy.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::


Observed Examples: ::REFERENCE:CVE-2004-0816:DESCRIPTION:Integer underflow in firewall via malformed packet.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-0816::REFERENCE:CVE-2004-1002:DESCRIPTION:Integer underflow by packet with invalid length.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-1002::REFERENCE:CVE-2005-0199:DESCRIPTION:Long input causes incorrect length calculation.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-0199::REFERENCE:CVE-2005-1891:DESCRIPTION:Malformed icon causes integer underflow in loop counter variable.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1891::
CWE-201: Insertion of Sensitive Information Into Sent Data (Base)

Description: The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Extended Description: Sensitive information could include data that is sensitive in and of itself (such as credentials or private messages), or otherwise useful in the further exploitation of the system (such as internal file system structure).



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Files or Directories:IMPACT:Read Memory:IMPACT:Read Application Data:NOTE:Sensitive data may be exposed to attackers.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Requirements:DESCRIPTION:Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.::PHASE:Implementation:DESCRIPTION:Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.::PHASE:System Configuration:DESCRIPTION:Setup default error messages so that unexpected errors do not disclose sensitive information.::PHASE:Architecture and Design:STRATEGY:Separation of Privilege:DESCRIPTION:Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.::

Observed Examples: ::REFERENCE:CVE-2022-0708:DESCRIPTION:Collaboration platform does not clear team emails in a response, allowing leak of email addresses:LINK:https://www.cve.org/CVERecord?id=CVE-2022-0708::
CWE-205: Observable Behavioral Discrepancy (Base)

Description: The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.

Extended Description: Ideally, a product should provide as little information about its internal operations as possible. Otherwise, attackers could use knowledge of these internal operations to simplify or optimize their attack. In some cases, behavioral discrepancies can be used by attackers to form a side channel.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Access Control:IMPACT:Read Application Data:IMPACT:Bypass Protection Mechanism::



Observed Examples: ::REFERENCE:CVE-2002-0208:DESCRIPTION:Product modifies TCP/IP stack and ICMP error messages in unusual ways that show the product is in use.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0208::REFERENCE:CVE-2004-2252:DESCRIPTION:Behavioral infoleak by responding to SYN-FIN packets.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-2252::
CWE-214: Invocation of Process Using Visible Sensitive Information (Base)

Description: A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Extended Description: Many operating systems allow a user to list information about processes that are owned by other users. Other users could see information such as command line arguments or environment variable settings. When this data contains sensitive information such as credentials, it might allow other users to launch an attack against the product or related resources.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::PHASE:Operation::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Application Data::



Observed Examples: ::REFERENCE:CVE-2005-1387:DESCRIPTION:password passed on command line:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1387::REFERENCE:CVE-2005-2291:DESCRIPTION:password passed on command line:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2291::REFERENCE:CVE-2001-1565:DESCRIPTION:username/password on command line allows local users to view via ps or other process listing programs:LINK:https://www.cve.org/CVERecord?id=CVE-2001-1565::REFERENCE:CVE-2004-1948:DESCRIPTION:Username/password on command line allows local users to view via ps or other process listing programs.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-1948::REFERENCE:CVE-1999-1270:DESCRIPTION:PGP passphrase provided as command line argument.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-1270::REFERENCE:CVE-2004-1058:DESCRIPTION:Kernel race condition allows reading of environment variables of a process that is still spawning.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-1058::REFERENCE:CVE-2021-32638:DESCRIPTION:Code analysis product passes access tokens as a command-line parameter or through an environment variable, making them visible to other processes via the ps command.:LINK:https://www.cve.org/CVERecord?id=CVE-2021-32638::


Affected Resources: ::System Process::

Notes: ::TYPE:Research Gap:NOTE:Under-studied, especially environment variables.::
CWE-215: Insertion of Sensitive Information Into Debugging Code (Base)

Description: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

Extended Description: When debugging, it may be necessary to report detailed information to the programmer. However, if the debugging code is not disabled when the product is operating in a production environment, then this sensitive information may be exposed to attackers.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Application Data::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Do not leave debug statements that could be executed in the source code. Ensure that all debug information is eradicated before releasing the software.::PHASE:Architecture and Design:STRATEGY:Separation of Privilege:DESCRIPTION:Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.::

Observed Examples: ::REFERENCE:CVE-2004-2268:DESCRIPTION:Password exposed in debug information.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-2268::REFERENCE:CVE-2002-0918:DESCRIPTION:CGI script includes sensitive information in debug messages when an error is triggered.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0918::REFERENCE:CVE-2003-1078:DESCRIPTION:FTP client with debug option enabled shows password to the screen.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-1078::



Notes: ::TYPE:Relationship:NOTE:This overlaps other categories.::
CWE-222: Truncation of Security-relevant Information (Base)

Description: The product truncates the display, recording, or processing of security-relevant information in a way that can obscure the source or nature of an attack.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::PHASE:Operation::



Common Consequences: ::SCOPE:Non-Repudiation:IMPACT:Hide Activities:NOTE:The source of an attack will be difficult or impossible to determine. This can allow attacks to the system to continue without notice.::



Observed Examples: ::REFERENCE:CVE-2005-0585:DESCRIPTION:Web browser truncates long sub-domains or paths, facilitating phishing.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-0585::REFERENCE:CVE-2004-2032:DESCRIPTION:Bypass URL filter via a long URL with a large number of trailing hex-encoded space characters.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-2032::REFERENCE:CVE-2003-0412:DESCRIPTION:application server does not log complete URI of a long request (truncation).:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0412::
CWE-223: Omission of Security-relevant Information (Base)

Description: The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.::PHASE:Implementation::PHASE:Operation::



Common Consequences: ::SCOPE:Non-Repudiation:IMPACT:Hide Activities:NOTE:The source of an attack will be difficult or impossible to determine. This can allow attacks to the system to continue without notice.::



Observed Examples: ::REFERENCE:CVE-1999-1029:DESCRIPTION:Login attempts are not recorded if the user disconnects before the maximum number of tries.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-1029::REFERENCE:CVE-2002-1839:DESCRIPTION:Sender's IP address not recorded in outgoing e-mail.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1839::REFERENCE:CVE-2000-0542:DESCRIPTION:Failed authentication attempts are not recorded if later attempt succeeds.:LINK:https://www.cve.org/CVERecord?id=CVE-2000-0542::
CWE-224: Obscured Security-relevant Information by Alternate Name (Base)

Description: The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::PHASE:Operation::



Common Consequences: ::SCOPE:Non-Repudiation:SCOPE:Access Control:IMPACT:Hide Activities:IMPACT:Gain Privileges or Assume Identity::



Observed Examples: ::REFERENCE:CVE-2002-0725:DESCRIPTION:Attacker performs malicious actions on a hard link to a file, obscuring the real target file.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0725::
CWE-229: Improper Handling of Values (Base)

Description: The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.





Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:IMPACT:Unexpected State::
CWE-233: Improper Handling of Parameters (Base)

Description: The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.





Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:IMPACT:Unexpected State::

Detection Methods: ::METHOD:Fuzzing:DESCRIPTION:Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.:EFFECTIVENESS:High::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::
CWE-237: Improper Handling of Structural Elements (Base)

Description: The product does not handle or incorrectly handles inputs that are related to complex structures.








Common Consequences: ::SCOPE:Integrity:IMPACT:Unexpected State::
CWE-241: Improper Handling of Unexpected Data Type (Base)

Description: The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Varies by Context:IMPACT:Unexpected State::


Potential Mitigations: ::PHASE:Implementation:STRATEGY:Input Validation:DESCRIPTION:Assume all input is malicious. Use an accept known good input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, boat may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as red or blue. Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.::PHASE:Implementation:STRATEGY:Input Validation:DESCRIPTION:Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.::

Observed Examples: ::REFERENCE:CVE-1999-1156:DESCRIPTION:FTP server crash via PORT command with non-numeric character.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-1156::REFERENCE:CVE-2004-0270:DESCRIPTION:Anti-virus product has assert error when line length is non-numeric.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-0270::



Notes: ::TYPE:Research Gap:NOTE:Probably under-studied.::
CWE-242: Use of Inherently Dangerous Function (Base)

Description: The product calls a function that can never be guaranteed to work safely.

Extended Description: Certain functions behave in dangerous ways regardless of how they are used. Functions in this category were often implemented without taking security concerns into account. The gets() function is unsafe because it does not perform bounds checking on the size of its input. An attacker can easily send arbitrarily-sized input to gets() and overflow the destination buffer. Similarly, the >> operator is unsafe to use when reading into a statically-allocated character array because it does not perform bounds checking on the size of its input. An attacker can easily send arbitrarily-sized input to the >> operator and overflow the destination buffer.



Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Varies by Context::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation Requirements:DESCRIPTION:Ban the use of dangerous functions. Use their safe equivalent.::PHASE:Testing:DESCRIPTION:Use grep or static analysis tools to spot usage of dangerous functions.::

Observed Examples: ::REFERENCE:CVE-2007-4004:DESCRIPTION:FTP client uses inherently insecure gets() function and is setuid root on some systems, allowing buffer overflow:LINK:https://www.cve.org/CVERecord?id=CVE-2007-4004::