Krutikp/ComplianceLLM huggingface dataset:
CWE-641: Improper Restriction of Names for Files and Other Resources (Base)

Description: The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.

Extended Description: This may produce resultant weaknesses. For instance, if the names of these resources contain scripting characters, it is possible that a script may get executed in the client's browser if the application ever displays the name of the resource on a dynamically generated web page. Alternately, if the resources are consumed by some application parser, a specially crafted name can exploit some vulnerability internal to the parser, potentially resulting in execution of arbitrary code on the server machine. The problems will vary based on the context of usage of such malformed resource names and whether vulnerabilities are present in or assumptions are made by the targeted technology that would make code execution possible.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Integrity:SCOPE:Confidentiality:SCOPE:Availability:IMPACT:Execute Unauthorized Code or Commands:NOTE:Execution of arbitrary code in the context of usage of the resources with dangerous names.::SCOPE:Confidentiality:SCOPE:Availability:IMPACT:Read Application Data:IMPACT:DoS: Crash, Exit, or Restart:NOTE:Crash of the consumer code of these resources resulting in information leakage or denial of service.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Do not allow users to control names of resources used on the server side.::PHASE:Architecture and Design:DESCRIPTION:Perform allowlist input validation at entry points and also before consuming the resources. Reject bad file names rather than trying to cleanse them.::PHASE:Architecture and Design:DESCRIPTION:Make sure that technologies consuming the resources are not vulnerable (e.g. buffer overflow, format string, etc.) in a way that would allow code execution if the name of the resource is malformed.::
CWE-645: Overly Restrictive Account Lockout Mechanism (Base)

Description: The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.

Extended Description: Account lockout is a security feature often present in applications as a countermeasure to the brute force attack on the password based authentication mechanism of the system. After a certain number of failed login attempts, the users' account may be disabled for a certain period of time or until it is unlocked by an administrator. Other security events may also possibly trigger account lockout. However, an attacker may use this very security feature to deny service to legitimate system users. It is therefore important to ensure that the account lockout security mechanism is not overly restrictive.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.::



Common Consequences: ::SCOPE:Availability:IMPACT:DoS: Resource Consumption (Other):NOTE:Users could be locked out of accounts.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Implement more intelligent password throttling mechanisms such as those which take IP address into account, in addition to the login name.::PHASE:Architecture and Design:DESCRIPTION:Implement a lockout timeout that grows as the number of incorrect login attempts goes up, eventually resulting in a complete lockout.::PHASE:Architecture and Design:DESCRIPTION:Consider alternatives to account lockout that would still be effective against password brute force attacks, such as presenting the user machine with a puzzle to solve (makes it do some computation).::
CWE-654: Reliance on a Single Factor in a Security Decision (Base)

Description: A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.



Alternate Terms: ::TERM:Separation of Privilege:DESCRIPTION:Some people and publications use the term Separation of Privilege to describe this weakness, but this term has dual meanings in current usage. While this entry is closely associated with the original definition of Separation of Privilege by Saltzer and Schroeder, others use the same term to describe poor compartmentalization (CWE-653). Because there are multiple interpretations, use of the Separation of Privilege term is discouraged.::

Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::PHASE:Operation::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:NOTE:If the single factor is compromised (e.g. by theft or spoofing), then the integrity of the entire security mechanism can be violated with respect to the user that is identified by that factor.::SCOPE:Non-Repudiation:IMPACT:Hide Activities:NOTE:It can become difficult or impossible for the product to be able to distinguish between legitimate activities by the entity who provided the factor, versus illegitimate activities by an attacker.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Use multiple simultaneous checks before granting access to critical operations or granting critical privileges. A weaker but helpful mitigation is to use several successive checks (multiple layers of security).::PHASE:Architecture and Design:DESCRIPTION:Use redundant access rules on different choke points (e.g., firewalls).::

Observed Examples: ::REFERENCE:CVE-2022-35248:DESCRIPTION:Chat application skips validation when Central Authentication Service (CAS) is enabled, effectively removing the second factor from two-factor authentication:LINK:https://www.cve.org/CVERecord?id=CVE-2022-35248::



Notes: ::TYPE:Maintenance:NOTE:This entry is closely associated with the term Separation of Privilege. This term is used in several different ways in the industry, but they generally combine two closely related principles: compartmentalization (CWE-653) and using only one factor in a security decision (this entry). Proper compartmentalization implicitly introduces multiple factors into a security decision, but there can be cases in which multiple factors are required for authentication or other mechanisms that do not involve compartmentalization, such as performing all required checks on a submitted certificate. It is likely that CWE-653 and CWE-654 will provoke further discussion.::
CWE-656: Reliance on Security Through Obscurity (Class)

Description: The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.

Extended Description: This reliance on security through obscurity can produce resultant weaknesses if an attacker is able to reverse engineer the inner workings of the mechanism. Note that obscurity can be one small part of defense in depth, since it can create more work for an attacker; however, it is a significant risk if used as the primary means of protection.


Alternate Terms: ::TERM:Never Assuming your secrets are safe::

Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Integrity:SCOPE:Availability:SCOPE:Other:IMPACT:Other:NOTE:The security mechanism can be bypassed easily.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Always consider whether knowledge of your code or design is sufficient to break it. Reverse engineering is a highly successful discipline, and financially feasible for motivated adversaries. Black-box techniques are established for binary analysis of executables that use obfuscation, runtime analysis of proprietary protocols, inferring file formats, and others.::PHASE:Architecture and Design:DESCRIPTION:When available, use publicly-vetted algorithms and procedures, as these are more likely to undergo more extensive security analysis and testing. This is especially the case with encryption and authentication.::

Observed Examples: ::REFERENCE:CVE-2006-6588:DESCRIPTION:Reliance on hidden form fields in a web application. Many web application vulnerabilities exist because the developer did not consider that hidden form fields can be processed using a modified client.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-6588::REFERENCE:CVE-2006-7142:DESCRIPTION:Hard-coded cryptographic key stored in executable program.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-7142::REFERENCE:CVE-2005-4002:DESCRIPTION:Hard-coded cryptographic key stored in executable program.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-4002::REFERENCE:CVE-2006-4068:DESCRIPTION:Hard-coded hashed values for username and password contained in client-side script, allowing brute-force offline attacks.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-4068::



Notes: ::TYPE:Relationship:NOTE:Note that there is a close relationship between this weakness and CWE-603 (Use of Client-Side Authentication). If developers do not believe that a user can reverse engineer a client, then they are more likely to choose client-side authentication in the belief that it is safe.::
CWE-663: Use of a Non-reentrant Function in a Concurrent Context (Base)

Description: The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.





Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Confidentiality:SCOPE:Other:IMPACT:Modify Memory:IMPACT:Read Memory:IMPACT:Modify Application Data:IMPACT:Read Application Data:IMPACT:Alter Execution Logic::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Use reentrant functions if available.::PHASE:Implementation:DESCRIPTION:Add synchronization to your non-reentrant function.::PHASE:Implementation:DESCRIPTION:In Java, use the ReentrantLock Class.::

Observed Examples: ::REFERENCE:CVE-2001-1349:DESCRIPTION:unsafe calls to library functions from signal handler:LINK:https://www.cve.org/CVERecord?id=CVE-2001-1349::REFERENCE:CVE-2004-2259:DESCRIPTION:SIGCHLD signal to FTP server can cause crash under heavy load while executing non-reentrant functions like malloc/free.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-2259::
CWE-681: Incorrect Conversion between Numeric Types (Base)

Description: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:SCOPE:Integrity:IMPACT:Unexpected State:IMPACT:Quality Degradation:NOTE:The program could wind up using the wrong number and generate incorrect results. If the number is used to allocate resources or make a security decision, then this could introduce a vulnerability.::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Avoid making conversion between numeric types. Always check for the allowed ranges.::

Observed Examples: ::REFERENCE:CVE-2022-2639:DESCRIPTION:Chain: integer coercion error (CWE-192) prevents a return value from indicating an error, leading to out-of-bounds write (CWE-787):LINK:https://www.cve.org/CVERecord?id=CVE-2022-2639::REFERENCE:CVE-2021-43537:DESCRIPTION:Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cause heap memory corruption (CWE-122):LINK:https://www.cve.org/CVERecord?id=CVE-2021-43537::REFERENCE:CVE-2007-4268:DESCRIPTION:Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122):LINK:https://www.cve.org/CVERecord?id=CVE-2007-4268::REFERENCE:CVE-2007-4988:DESCRIPTION:Chain: signed short width value in image processor is sign extended during conversion to unsigned int, which leads to integer overflow and heap-based buffer overflow.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-4988::REFERENCE:CVE-2009-0231:DESCRIPTION:Integer truncation of length value leads to heap-based buffer overflow.:LINK:https://www.cve.org/CVERecord?id=CVE-2009-0231::REFERENCE:CVE-2008-3282:DESCRIPTION:Size of a particular type changes for 64-bit platforms, leading to an integer truncation in document processor causes incorrect index to be generated.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-3282::
CWE-694: Use of Multiple Resources with Duplicate Identifier (Base)

Description: The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

Extended Description: If the product assumes that each resource has a unique identifier, the product could operate on the wrong resource if attackers can cause multiple resources to be associated with the same identifier.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Access Control:IMPACT:Bypass Protection Mechanism:NOTE:If unique identifiers are assumed when protecting sensitive resources, then duplicate identifiers might allow attackers to bypass the protection.::SCOPE:Other:IMPACT:Quality Degradation::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.::

Observed Examples: ::REFERENCE:CVE-2013-4787:DESCRIPTION:chain: mobile OS verifies cryptographic signature of file in an archive, but then installs a different file with the same name that is also listed in the archive.:LINK:https://www.cve.org/CVERecord?id=CVE-2013-4787::



Notes: ::TYPE:Relationship:NOTE:This weakness is probably closely associated with other issues related to doubling, such as CWE-675 (Duplicate Operations on Resource). It's often a case of an API contract violation (CWE-227).::
CWE-695: Use of Low-Level Functionality (Base)

Description: The product uses low-level functionality that is explicitly prohibited by the framework or specification under which the product is supposed to operate.

Extended Description: The use of low-level functionality can violate the specification in unexpected ways that effectively disable built-in protection mechanisms, introduce exploitable inconsistencies, or otherwise expose the functionality to attack.




Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Other::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::
CWE-698: Execution After Redirect (EAR) (Base)

Description: The web application sends a redirect to another location, but instead of exiting, it executes additional code.



Alternate Terms: ::TERM:Redirect Without Exit::


Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:SCOPE:Confidentiality:SCOPE:Integrity:SCOPE:Availability:IMPACT:Alter Execution Logic:IMPACT:Execute Unauthorized Code or Commands:NOTE:This weakness could affect the control flow of the application and allow execution of untrusted code.::

Detection Methods: ::METHOD:Black Box:DESCRIPTION:This issue might not be detected if testing is performed using a web browser, because the browser might obey the redirect and move the user to a different page before the application has produced outputs that indicate something is amiss.::


Observed Examples: ::REFERENCE:CVE-2013-1402:DESCRIPTION:Execution-after-redirect allows access to application configuration details.:LINK:https://www.cve.org/CVERecord?id=CVE-2013-1402::REFERENCE:CVE-2009-1936:DESCRIPTION:chain: library file sends a redirect if it is directly requested but continues to execute, allowing remote file inclusion and path traversal.:LINK:https://www.cve.org/CVERecord?id=CVE-2009-1936::REFERENCE:CVE-2007-2713:DESCRIPTION:Remote attackers can obtain access to administrator functionality through EAR.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-2713::REFERENCE:CVE-2007-4932:DESCRIPTION:Remote attackers can obtain access to administrator functionality through EAR.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-4932::REFERENCE:CVE-2007-5578:DESCRIPTION:Bypass of authentication step through EAR.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-5578::REFERENCE:CVE-2007-2713:DESCRIPTION:Chain: Execution after redirect triggers eval injection.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-2713::REFERENCE:CVE-2007-6652:DESCRIPTION:chain: execution after redirect allows non-administrator to perform static code injection.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-6652::
CWE-708: Incorrect Ownership Assignment (Base)

Description: The product assigns an owner to a resource, but the owner is outside of the intended control sphere.

Extended Description: This may allow the resource to be manipulated by actors outside of the intended control sphere.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::PHASE:Operation::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Integrity:IMPACT:Read Application Data:IMPACT:Modify Application Data:NOTE:An attacker could read and modify data for which they do not have permissions to access directly.::


Potential Mitigations: ::PHASE:Policy:DESCRIPTION:Periodically review the privileges and their owners.::PHASE:Testing:DESCRIPTION:Use automated tools to check for privilege settings.::

Observed Examples: ::REFERENCE:CVE-2007-5101:DESCRIPTION:File system sets wrong ownership and group when creating a new file.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-5101::REFERENCE:CVE-2007-4238:DESCRIPTION:OS installs program with bin owner/group, allowing modification.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-4238::REFERENCE:CVE-2007-1716:DESCRIPTION:Manager does not properly restore ownership of a reusable resource when a user logs out, allowing privilege escalation.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-1716::REFERENCE:CVE-2005-3148:DESCRIPTION:Backup software restores symbolic links with incorrect uid/gid.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-3148::REFERENCE:CVE-2005-1064:DESCRIPTION:Product changes the ownership of files that a symlink points to, instead of the symlink itself.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1064::REFERENCE:CVE-2011-1551:DESCRIPTION:Component assigns ownership of sensitive directory tree to a user account, which can be leveraged to perform privileged operations.:LINK:https://www.cve.org/CVERecord?id=CVE-2011-1551::



Notes: ::TYPE:Maintenance:NOTE:This overlaps verification errors, permissions, and privileges. A closely related weakness is the incorrect assignment of groups to a resource. It is not clear whether it would fall under this entry or require a different entry.::
CWE-733: Compiler Optimization Removal or Modification of Security-critical Code (Base)

Description: The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.




Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Often::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Often::LANGUAGE CLASS:Compiled:LANGUAGE PREVALENCE:Undetermined::




Common Consequences: ::SCOPE:Access Control:SCOPE:Other:IMPACT:Bypass Protection Mechanism:IMPACT:Other::

Detection Methods: ::METHOD:Black Box:DESCRIPTION:This specific weakness is impossible to detect using black box methods. While an analyst could examine memory to see that it has not been scrubbed, an analysis of the executable would not be successful. This is because the compiler has already removed the relevant code. Only the source code shows whether the programmer intended to clear the memory or not, so this weakness is indistinguishable from others.::METHOD:White Box:DESCRIPTION:This weakness is only detectable using white box methods (see black box detection factor). Careful analysis is required to determine if the code is likely to be removed by the compiler.::


Observed Examples: ::REFERENCE:CVE-2008-1685:DESCRIPTION:C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-1685::REFERENCE:CVE-2019-1010006:DESCRIPTION:Chain: compiler optimization (CWE-733) removes or modifies code used to detect integer overflow (CWE-190), allowing out-of-bounds write (CWE-787).:LINK:https://www.cve.org/CVERecord?id=CVE-2019-1010006::
CWE-756: Missing Custom Error Page (Base)

Description: The product does not return custom error pages to the user, possibly exposing sensitive information.








Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Application Data:NOTE:Attackers can leverage the additional information provided by a default error page to mount attacks targeted on the framework, database, or other resources used by the application.::