Krutikp/ComplianceLLM huggingface dataset:
CWE-347: Improper Verification of Cryptographic Signature (Base)

Description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Access Control:SCOPE:Integrity:SCOPE:Confidentiality:IMPACT:Gain Privileges or Assume Identity:IMPACT:Modify Application Data:IMPACT:Execute Unauthorized Code or Commands:NOTE:An attacker could gain access to sensitive data and possibly execute unauthorized code.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::


Observed Examples: ::REFERENCE:CVE-2002-1796:DESCRIPTION:Does not properly verify signatures for trusted entities.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1796::REFERENCE:CVE-2005-2181:DESCRIPTION:Insufficient verification allows spoofing.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2181::REFERENCE:CVE-2005-2182:DESCRIPTION:Insufficient verification allows spoofing.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2182::REFERENCE:CVE-2002-1706:DESCRIPTION:Accepts a configuration file without a Message Integrity Check (MIC) signature.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1706::
CWE-348: Use of Less Trusted Source (Base)

Description: The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Access Control:IMPACT:Bypass Protection Mechanism:IMPACT:Gain Privileges or Assume Identity:NOTE:An attacker could utilize the untrusted data source to bypass protection mechanisms and gain access to sensitive data.::



Observed Examples: ::REFERENCE:CVE-2001-0860:DESCRIPTION:Product uses IP address provided by a client, instead of obtaining it from the packet headers, allowing easier spoofing.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0860::REFERENCE:CVE-2004-1950:DESCRIPTION:Web product uses the IP address in the X-Forwarded-For HTTP header instead of a server variable that uses the connecting IP address, allowing filter bypass.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-1950::REFERENCE:CVE-2001-0908:DESCRIPTION:Product logs IP address specified by the client instead of obtaining it from the packet headers, allowing information hiding.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0908::REFERENCE:CVE-2006-1126:DESCRIPTION:PHP application uses IP address from X-Forwarded-For HTTP header, instead of REMOTE_ADDR.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-1126::
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data (Base)

Description: The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Access Control:SCOPE:Integrity:IMPACT:Bypass Protection Mechanism:IMPACT:Modify Application Data:NOTE:An attacker could package untrusted data with trusted data to bypass protection mechanisms to gain access to and possibly modify sensitive data.::



Observed Examples: ::REFERENCE:CVE-2002-0018:DESCRIPTION:Does not verify that trusted entity is authoritative for all entities in its response.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0018::REFERENCE:CVE-2006-5462:DESCRIPTION:use of extra data in a signature allows certificate signature forging:LINK:https://www.cve.org/CVERecord?id=CVE-2006-5462::
CWE-351: Insufficient Type Distinction (Base)

Description: The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Other:IMPACT:Other::



Observed Examples: ::REFERENCE:CVE-2005-2260:DESCRIPTION:Browser user interface does not distinguish between user-initiated and synthetic events.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2260::REFERENCE:CVE-2005-2801:DESCRIPTION:Product does not compare all required data in two separate elements, causing it to think they are the same, leading to loss of ACLs. Similar to Same Name error.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2801::



Notes: ::TYPE:Relationship:NOTE:Overlaps others, e.g. Multiple Interpretation Errors.::
CWE-353: Missing Support for Integrity Check (Base)

Description: The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

Extended Description: If integrity check values or checksums are omitted from a protocol, there is no way of determining if data has been corrupted in transmission. The lack of checksum functionality in a protocol removes the first application-level check of data that can be used. The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Other:NOTE:Data that is parsed and used may be corrupted.::SCOPE:Non-Repudiation:SCOPE:Other:IMPACT:Hide Activities:IMPACT:Other:NOTE:Without a checksum it is impossible to determine if any changes have been made to the data after it was sent.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Add an appropriately sized checksum to the protocol, ensuring that data received may be simply validated before it is parsed and used.::PHASE:Implementation:DESCRIPTION:Ensure that the checksums present in the protocol design are properly implemented and added to each message before it is sent.::
CWE-354: Improper Validation of Integrity Check Value (Base)

Description: The product does not validate or incorrectly validates the integrity check values or checksums of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Extended Description: Improper validation of checksums before use results in an unnecessary risk that can easily be mitigated. The protocol specification describes the algorithm used for calculating the checksum. It is then a simple matter of implementing the calculation and verifying that the calculated checksum and the received checksum match. Improper verification of the calculated checksum and the received checksum can lead to far greater consequences.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Modify Application Data:IMPACT:Other:NOTE:Integrity checks usually use a secret key that helps authenticate the data origin. Skipping integrity checking generally opens up the possibility that new data from an invalid source can be injected.::SCOPE:Integrity:SCOPE:Other:IMPACT:Other:NOTE:Data that is parsed and used may be corrupted.::SCOPE:Non-Repudiation:SCOPE:Other:IMPACT:Hide Activities:IMPACT:Other:NOTE:Without a checksum check, it is impossible to determine if any changes have been made to the data after it was sent.::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Ensure that the checksums present in messages are properly checked in accordance with the protocol specification before they are parsed and used.::
CWE-356: Product UI does not Warn User of Unsafe Actions (Base)

Description: The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system.

Extended Description: Product systems should warn users that a potentially dangerous action may occur if the user proceeds. For example, if the user downloads a file from an unknown source and attempts to execute the file on their machine, then the application's GUI can indicate that the file is unsafe.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Non-Repudiation:IMPACT:Hide Activities::



Observed Examples: ::REFERENCE:CVE-1999-1055:DESCRIPTION:Product does not warn user when document contains certain dangerous functions or macros.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-1055::REFERENCE:CVE-1999-0794:DESCRIPTION:Product does not warn user when document contains certain dangerous functions or macros.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-0794::REFERENCE:CVE-2000-0277:DESCRIPTION:Product does not warn user when document contains certain dangerous functions or macros.:LINK:https://www.cve.org/CVERecord?id=CVE-2000-0277::REFERENCE:CVE-2000-0517:DESCRIPTION:Product does not warn user about a certificate if it has already been accepted for a different site. Possibly resultant.:LINK:https://www.cve.org/CVERecord?id=CVE-2000-0517::REFERENCE:CVE-2005-0602:DESCRIPTION:File extractor does not warn user if setuid/setgid files could be extracted. Overlaps privileges/permissions.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-0602::REFERENCE:CVE-2000-0342:DESCRIPTION:E-mail client allows bypass of warning for dangerous attachments via a Windows .LNK file that refers to the attachment.:LINK:https://www.cve.org/CVERecord?id=CVE-2000-0342::



Notes: ::TYPE:Relationship:NOTE:Often resultant, e.g. in unhandled error conditions.::TYPE:Relationship:NOTE:Can overlap privilege errors, conceptually at least.::
CWE-357: Insufficient UI Warning of Dangerous Operations (Base)

Description: The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Non-Repudiation:IMPACT:Hide Activities::



Observed Examples: ::REFERENCE:CVE-2007-1099:DESCRIPTION:User not sufficiently warned if host key mismatch occurs:LINK:https://www.cve.org/CVERecord?id=CVE-2007-1099::
CWE-358: Improperly Implemented Security Check for Standard (Base)

Description: The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation:NOTE:This is an implementation error, in which the algorithm/technique requires certain security-related behaviors or conditions that are not implemented or checked properly, thus causing a vulnerability.::



Common Consequences: ::SCOPE:Access Control:IMPACT:Bypass Protection Mechanism::



Observed Examples: ::REFERENCE:CVE-2002-0862:DESCRIPTION:Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0862::REFERENCE:CVE-2002-0970:DESCRIPTION:Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0970::REFERENCE:CVE-2002-1407:DESCRIPTION:Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1407::REFERENCE:CVE-2005-0198:DESCRIPTION:Logic error prevents some required conditions from being enforced during Challenge-Response Authentication Mechanism with MD5 (CRAM-MD5).:LINK:https://www.cve.org/CVERecord?id=CVE-2005-0198::REFERENCE:CVE-2004-2163:DESCRIPTION:Shared secret not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-2163::REFERENCE:CVE-2005-2181:DESCRIPTION:Insufficient verification in VoIP implementation, in violation of standard, allows spoofed messages.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2181::REFERENCE:CVE-2005-2182:DESCRIPTION:Insufficient verification in VoIP implementation, in violation of standard, allows spoofed messages.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2182::REFERENCE:CVE-2005-2298:DESCRIPTION:Security check not applied to all components, allowing bypass.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2298::



Notes: ::TYPE:Relationship:NOTE:This is a missing step error on the product side, which can overlap weaknesses such as insufficient verification and spoofing. It is frequently found in cryptographic and authentication errors. It is sometimes resultant.::
CWE-360: Trust of System Event Data (Base)

Description: Security based on event locations are insecure and can be spoofed.

Extended Description: Events are a messaging system which may provide control data to programs listening for events. Events often do not have any type of authentication framework to allow them to be verified from a trusted source. Any application, in Windows, on a given desktop can send a message to any window on the same desktop. There is no authentication framework for these messages. Therefore, any message can be used to manipulate any process on the desktop if the process does not check the validity and safeness of those messages.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Confidentiality:SCOPE:Availability:SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:IMPACT:Execute Unauthorized Code or Commands:NOTE:If one trusts the system-event information and executes commands based on it, one could potentially take actions based on a spoofed identity.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Never trust or rely any of the information in an Event for security.::

Observed Examples: ::REFERENCE:CVE-2004-0213:DESCRIPTION:Attacker uses Shatter attack to bypass GUI-enforced protection for CVE-2003-0908.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-0213::
CWE-366: Race Condition within a Thread (Base)

Description: If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.




Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C#:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Alter Execution Logic:IMPACT:Unexpected State:NOTE:The main problem is that -- if a lock is overcome -- data could be altered in a bad state.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Use locking functionality. This is the recommended solution. Implement some form of locking mechanism around code which alters or reads persistent data in a multithreaded environment.::PHASE:Architecture and Design:DESCRIPTION:Create resource-locking validation checks. If no inherent locking mechanisms exist, use flags and signals to enforce your own blocking scheme when resources are being used by other threads of execution.::

Observed Examples: ::REFERENCE:CVE-2022-2621:DESCRIPTION:Chain: two threads in a web browser use the same resource (CWE-366), but one of those threads can destroy the resource before the other has completed (CWE-416).:LINK:https://www.cve.org/CVERecord?id=CVE-2022-2621::


Affected Resources: ::System Process::
CWE-368: Context Switching Race Condition (Base)

Description: A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product's behavior during the switch.

Extended Description: This is commonly seen in web browser vulnerabilities in which the attacker can perform certain actions while the browser is transitioning from a trusted to an untrusted domain, or vice versa, and the browser performs the actions on one domain using the trust level and resources of the other domain.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Confidentiality:IMPACT:Modify Application Data:IMPACT:Read Application Data::



Observed Examples: ::REFERENCE:CVE-2009-1837:DESCRIPTION:Chain: race condition (CWE-362) from improper handling of a page transition in web client while an applet is loading (CWE-368) leads to use after free (CWE-416):LINK:https://www.cve.org/CVERecord?id=CVE-2009-1837::REFERENCE:CVE-2004-2260:DESCRIPTION:Browser updates address bar as soon as user clicks on a link instead of when the page has loaded, allowing spoofing by redirecting to another page using onUnload method. ** this is one example of the role of hooks and context switches, and should be captured somehow - also a race condition of sorts **:LINK:https://www.cve.org/CVERecord?id=CVE-2004-2260::REFERENCE:CVE-2004-0191:DESCRIPTION:XSS when web browser executes Javascript events in the context of a new page while it's being loaded, allowing interaction with previous page in different domain.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-0191::REFERENCE:CVE-2004-2491:DESCRIPTION:Web browser fills in address bar of clicked-on link before page has been loaded, and doesn't update afterward.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-2491::



Notes: ::TYPE:Relationship:NOTE:Can overlap signal handler race conditions.::TYPE:Research Gap:NOTE:Under-studied as a concept. Frequency unknown; few vulnerability reports give enough detail to know when a context switching race condition is a factor.::
CWE-369: Divide By Zero (Base)

Description: The product divides a value by zero.

Extended Description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.




Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Availability:IMPACT:DoS: Crash, Exit, or Restart:NOTE:A Divide by Zero results in a crash.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::METHOD:Fuzzing:DESCRIPTION:Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.:EFFECTIVENESS:High::


Observed Examples: ::REFERENCE:CVE-2007-3268:DESCRIPTION:Invalid size value leads to divide by zero.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-3268::REFERENCE:CVE-2007-2723:DESCRIPTION:Empty content triggers divide by zero.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-2723::REFERENCE:CVE-2007-2237:DESCRIPTION:Height value of 0 triggers divide by zero.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-2237::
CWE-372: Incomplete Internal State Distinction (Base)

Description: The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Varies by Context:IMPACT:Unexpected State::






Notes: ::TYPE:Relationship:NOTE:This conceptually overlaps other categories such as insufficient verification, but this entry refers to the product's incorrect perception of its own state.::TYPE:Relationship:NOTE:This is probably resultant from other weaknesses such as unhandled error conditions, inability to handle out-of-order steps, multiple interpretation errors, etc.::TYPE:Maintenance:NOTE:This entry is being considered for deprecation. It was poorly-defined in PLOVER and is not easily described using the behavior/resource/property model of vulnerability theory.::