Krutikp/ComplianceLLM huggingface dataset:
CWE-832: Unlock of a Resource that is not Locked (Base)

Description: The product attempts to unlock a resource that is not locked.

Extended Description: Depending on the locking functionality, an unlock of a non-locked resource might cause memory corruption or other modification to the resource (or its associated metadata that is used for tracking locks).







Common Consequences: ::SCOPE:Integrity:SCOPE:Confidentiality:SCOPE:Availability:SCOPE:Other:IMPACT:DoS: Crash, Exit, or Restart:IMPACT:Execute Unauthorized Code or Commands:IMPACT:Modify Memory:IMPACT:Other:NOTE:Depending on the locking being used, an unlock operation might not have any adverse effects. When effects exist, the most common consequence will be a corruption of the state of the product, possibly leading to a crash or exit; depending on the implementation of the unlocking, memory corruption or code execution could occur.::



Observed Examples: ::REFERENCE:CVE-2010-4210:DESCRIPTION:function in OS kernel unlocks a mutex that was not previously locked, causing a panic or overwrite of arbitrary memory.:LINK:https://www.cve.org/CVERecord?id=CVE-2010-4210::REFERENCE:CVE-2008-4302:DESCRIPTION:Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-4302::REFERENCE:CVE-2009-1243:DESCRIPTION:OS kernel performs an unlock in some incorrect circumstances, leading to panic.:LINK:https://www.cve.org/CVERecord?id=CVE-2009-1243::
CWE-833: Deadlock (Base)

Description: The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.








Common Consequences: ::SCOPE:Availability:IMPACT:DoS: Resource Consumption (CPU):IMPACT:DoS: Resource Consumption (Other):IMPACT:DoS: Crash, Exit, or Restart:NOTE:Each thread of execution will hang and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.::



Observed Examples: ::REFERENCE:CVE-1999-1476:DESCRIPTION:A bug in some Intel Pentium processors allow DoS (hang) via an invalid CMPXCHG8B instruction, causing a deadlock:LINK:https://www.cve.org/CVERecord?id=CVE-1999-1476::REFERENCE:CVE-2009-2857:DESCRIPTION:OS deadlock:LINK:https://www.cve.org/CVERecord?id=CVE-2009-2857::REFERENCE:CVE-2009-1961:DESCRIPTION:OS deadlock involving 3 separate functions:LINK:https://www.cve.org/CVERecord?id=CVE-2009-1961::REFERENCE:CVE-2009-2699:DESCRIPTION:deadlock in library:LINK:https://www.cve.org/CVERecord?id=CVE-2009-2699::REFERENCE:CVE-2009-4272:DESCRIPTION:deadlock triggered by packets that force collisions in a routing table:LINK:https://www.cve.org/CVERecord?id=CVE-2009-4272::REFERENCE:CVE-2002-1850:DESCRIPTION:read/write deadlock between web server and script:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1850::REFERENCE:CVE-2004-0174:DESCRIPTION:web server deadlock involving multiple listening connections:LINK:https://www.cve.org/CVERecord?id=CVE-2004-0174::REFERENCE:CVE-2009-1388:DESCRIPTION:multiple simultaneous calls to the same function trigger deadlock.:LINK:https://www.cve.org/CVERecord?id=CVE-2009-1388::REFERENCE:CVE-2006-5158:DESCRIPTION:chain: other weakness leads to NULL pointer dereference (CWE-476) or deadlock (CWE-833).:LINK:https://www.cve.org/CVERecord?id=CVE-2006-5158::REFERENCE:CVE-2006-4342:DESCRIPTION:deadlock when an operation is performed on a resource while it is being removed.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-4342::REFERENCE:CVE-2006-2374:DESCRIPTION:Deadlock in device driver triggered by using file handle of a related device.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-2374::REFERENCE:CVE-2006-2275:DESCRIPTION:Deadlock when large number of small messages cannot be processed quickly enough.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-2275::REFERENCE:CVE-2005-3847:DESCRIPTION:OS kernel has deadlock triggered by a signal during a core dump.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-3847::REFERENCE:CVE-2005-3106:DESCRIPTION:Race condition leads to deadlock.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-3106::REFERENCE:CVE-2005-2456:DESCRIPTION:Chain: array index error (CWE-129) leads to deadlock (CWE-833):LINK:https://www.cve.org/CVERecord?id=CVE-2005-2456::
CWE-836: Use of Password Hash Instead of Password for Authentication (Base)

Description: The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.

Extended Description: Some authentication mechanisms rely on the client to generate the hash for a password, possibly to reduce load on the server or avoid sending the password across the network. However, when the client is used to generate the hash, an attacker can bypass the authentication by obtaining a copy of the hash, e.g. by using SQL injection to compromise a database of authentication credentials, or by exploiting an information exposure. The attacker could then use a modified client to replay the stolen hash without having knowledge of the original password. As a result, the server-side comparison against a client-side hash does not provide any more security than the use of passwords without hashing.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Access Control:IMPACT:Bypass Protection Mechanism:IMPACT:Gain Privileges or Assume Identity:NOTE:An attacker could bypass the authentication routine without knowing the original password.::



Observed Examples: ::REFERENCE:CVE-2009-1283:DESCRIPTION:Product performs authentication with user-supplied password hashes that can be obtained from a separate SQL injection vulnerability (CVE-2009-1282).:LINK:https://www.cve.org/CVERecord?id=CVE-2009-1283::REFERENCE:CVE-2005-3435:DESCRIPTION:Product allows attackers to bypass authentication by obtaining the password hash for another user and specifying the hash in the pwd argument.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-3435::
CWE-837: Improper Enforcement of a Single, Unique Action (Base)

Description: The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.

Extended Description: In various applications, a user is only expected to perform a certain action once, such as voting, requesting a refund, or making a purchase. When this restriction is not enforced, sometimes this can have security implications. For example, in a voting application, an attacker could attempt to stuff the ballot box by voting multiple times. If these votes are counted separately, then the attacker could directly affect who wins the vote. This could have significant business impact depending on the purpose of the product.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::




Common Consequences: ::SCOPE:Other:IMPACT:Varies by Context:NOTE:An attacker might be able to gain advantage over other users by performing the action multiple times, or affect the correctness of the product.::



Observed Examples: ::REFERENCE:CVE-2008-0294:DESCRIPTION:Ticket-booking web application allows a user to lock a seat more than once.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-0294::REFERENCE:CVE-2005-4051:DESCRIPTION:CMS allows people to rate downloads by voting more than once.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-4051::REFERENCE:CVE-2002-216:DESCRIPTION:Polling software allows people to vote more than once by setting a cookie.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-216::REFERENCE:CVE-2003-1433:DESCRIPTION:Chain: lack of validation of a challenge key in a game allows a player to register multiple times and lock other players out of the game.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-1433::REFERENCE:CVE-2002-1018:DESCRIPTION:Library feature allows attackers to check out the same e-book multiple times, preventing other users from accessing copies of the e-book.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1018::REFERENCE:CVE-2009-2346:DESCRIPTION:Protocol implementation allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many message exchanges.:LINK:https://www.cve.org/CVERecord?id=CVE-2009-2346::
CWE-842: Placement of User into Incorrect Group (Base)

Description: The product or the administrator places a user into an incorrect group.

Extended Description: If the incorrect group has more access or privileges than the intended group, the user might be able to bypass intended security policy to access unexpected resources or perform unexpected actions. The access-control system might not be able to detect malicious usage of this group membership.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::PHASE:Operation::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity::



Observed Examples: ::REFERENCE:CVE-1999-1193:DESCRIPTION:Operating system assigns user to privileged wheel group, allowing the user to gain root privileges.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-1193::REFERENCE:CVE-2010-3716:DESCRIPTION:Chain: drafted web request allows the creation of users with arbitrary group membership.:LINK:https://www.cve.org/CVERecord?id=CVE-2010-3716::REFERENCE:CVE-2008-5397:DESCRIPTION:Chain: improper processing of configuration options causes users to contain unintended group memberships.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-5397::REFERENCE:CVE-2007-6644:DESCRIPTION:CMS does not prevent remote administrators from promoting other users to the administrator group, in violation of the intended security model.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-6644::REFERENCE:CVE-2007-3260:DESCRIPTION:Product assigns members to the root group, allowing escalation of privileges.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-3260::REFERENCE:CVE-2002-0080:DESCRIPTION:Chain: daemon does not properly clear groups before dropping privileges.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0080::
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') (Base)

Description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Extended Description: When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access. While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways. This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.


Alternate Terms: ::TERM:Object Type Confusion::

Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Availability:SCOPE:Integrity:SCOPE:Confidentiality:IMPACT:Read Memory:IMPACT:Modify Memory:IMPACT:Execute Unauthorized Code or Commands:IMPACT:DoS: Crash, Exit, or Restart:NOTE:When a memory buffer is accessed using the wrong type, it could read or write memory out of the bounds of the buffer, if the allocated buffer is smaller than the type that the code is attempting to access, leading to a crash and possibly code execution.::



Observed Examples: ::REFERENCE:CVE-2010-4577:DESCRIPTION:Type confusion in CSS sequence leads to out-of-bounds read.:LINK:https://www.cve.org/CVERecord?id=CVE-2010-4577::REFERENCE:CVE-2011-0611:DESCRIPTION:Size inconsistency allows code execution, first discovered when it was actively exploited in-the-wild.:LINK:https://www.cve.org/CVERecord?id=CVE-2011-0611::REFERENCE:CVE-2010-0258:DESCRIPTION:Improperly-parsed file containing records of different types leads to code execution when a memory location is interpreted as a different object than intended.:LINK:https://www.cve.org/CVERecord?id=CVE-2010-0258::



Notes: ::TYPE:Applicable Platform:NOTE:This weakness is possible in any type-unsafe programming language.::TYPE:Research Gap:NOTE:Type confusion weaknesses have received some attention by applied researchers and major software vendors for C and C++ code. Some publicly-reported vulnerabilities probably have type confusion as a root-cause weakness, but these may be described as memory corruption instead. For other languages, there are very few public reports of type confusion weaknesses. These are probably under-studied. Since many programs rely directly or indirectly on loose typing, a potential type confusion behavior might be intentional, possibly requiring more manual analysis.::
CWE-909: Missing Initialization of Resource (Class)

Description: The product does not initialize a critical resource.

Extended Description: Many resources require initialization before they can be properly used. If a resource is not initialized, it could contain unpredictable or expired data, or it could be initialized to defaults that are invalid. This can have security implications when the resource is expected to have certain properties or values.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Memory:IMPACT:Read Application Data:NOTE:When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party.::SCOPE:Availability:IMPACT:DoS: Crash, Exit, or Restart:NOTE:The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend.::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all specified steps.::PHASE:Implementation:DESCRIPTION:Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.::PHASE:Implementation:DESCRIPTION:Avoid race conditions (CWE-362) during initialization routines.::PHASE:Build and Compilation:DESCRIPTION:Run or compile your product with settings that generate warnings about uninitialized variables or data.::

Observed Examples: ::REFERENCE:CVE-2020-20739:DESCRIPTION:A variable that has its value set in a conditional statement is sometimes used when the conditional fails, sometimes causing data leakage:LINK:https://www.cve.org/CVERecord?id=CVE-2020-20739::REFERENCE:CVE-2005-1036:DESCRIPTION:Chain: Bypass of access restrictions due to improper authorization (CWE-862) of a user results from an improperly initialized (CWE-909) I/O permission bitmap:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1036::
CWE-910: Use of Expired File Descriptor (Base)

Description: The product uses or accesses a file descriptor after it has been closed.

Extended Description: After a file descriptor for a particular file or device has been released, it can be reused. The code might not write to the original file, since the reused file descriptor might reference a different file or device.


Alternate Terms: ::TERM:Stale file descriptor::

Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Sometimes::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Sometimes::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Files or Directories:NOTE:The program could read data from the wrong file.::SCOPE:Availability:IMPACT:DoS: Crash, Exit, or Restart:NOTE:Accessing a file descriptor that has been closed can cause a crash.::
CWE-914: Improper Control of Dynamically-Identified Variables (Base)

Description: The product does not properly restrict reading from or writing to dynamically-identified variables.

Extended Description: Many languages offer powerful features that allow the programmer to access arbitrary variables that are specified by an input string. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can modify unintended variables that have security implications.




Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:IMPACT:Modify Application Data:NOTE:An attacker could modify sensitive data or program variables.::SCOPE:Integrity:IMPACT:Execute Unauthorized Code or Commands::SCOPE:Other:SCOPE:Integrity:IMPACT:Varies by Context:IMPACT:Alter Execution Logic::


Potential Mitigations: ::PHASE:Implementation:STRATEGY:Input Validation:DESCRIPTION:For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.::PHASE:Implementation Architecture and Design:STRATEGY:Refactoring:DESCRIPTION:Refactor the code so that internal program variables do not need to be dynamically identified.::

Observed Examples: ::REFERENCE:CVE-2006-7135:DESCRIPTION:extract issue enables file inclusion:LINK:https://www.cve.org/CVERecord?id=CVE-2006-7135::REFERENCE:CVE-2006-7079:DESCRIPTION:Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22):LINK:https://www.cve.org/CVERecord?id=CVE-2006-7079::REFERENCE:CVE-2007-0649:DESCRIPTION:extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-0649::REFERENCE:CVE-2006-6661:DESCRIPTION:extract() enables static code injection:LINK:https://www.cve.org/CVERecord?id=CVE-2006-6661::REFERENCE:CVE-2006-2828:DESCRIPTION:import_request_variables() buried in include files makes post-disclosure analysis confusing:LINK:https://www.cve.org/CVERecord?id=CVE-2006-2828::REFERENCE:CVE-2009-0422:DESCRIPTION:Chain: Dynamic variable evaluation allows resultant remote file inclusion and path traversal.:LINK:https://www.cve.org/CVERecord?id=CVE-2009-0422::REFERENCE:CVE-2007-2431:DESCRIPTION:Chain: dynamic variable evaluation in PHP program used to modify critical, unexpected $_SERVER variable for resultant XSS.:LINK:https://www.cve.org/CVERecord?id=CVE-2007-2431::REFERENCE:CVE-2006-4904:DESCRIPTION:Chain: dynamic variable evaluation in PHP program used to conduct remote file inclusion.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-4904::REFERENCE:CVE-2006-4019:DESCRIPTION:Dynamic variable evaluation in mail program allows reading and modifying attachments and preferences of other users.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-4019::
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') (Base)

Description: The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Extended Description: Frameworks such as Java Server Page (JSP) allow a developer to insert executable expressions within otherwise-static content. When the developer is not aware of the executable nature of these expressions and/or does not disable them, then if an attacker can inject expressions, this could lead to code execution or other unexpected behaviors.


Alternate Terms: ::TERM:EL Injection::

Applicable Platforms: ::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Application Data::SCOPE:Integrity:IMPACT:Execute Unauthorized Code or Commands::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Avoid adding user-controlled data into an expression interpreter when possible.::PHASE:Implementation:DESCRIPTION:If user-controlled data must be added to an expression interpreter, one or more of the following should be performed: Validate that the user input will not evaluate as an expression Encode the user input in a way that ensures it is not evaluated as an expression::PHASE:System Configuration Operation:DESCRIPTION:The framework or tooling might allow the developer to disable or deactivate the processing of EL expressions, such as setting the isELIgnored attribute for a JSP page to true.::

Observed Examples: ::REFERENCE:CVE-2021-44228:DESCRIPTION:Product does not neutralize ${xyz} style expressions, allowing remote code execution. (log4shell vulnerability in log4j):LINK:https://www.cve.org/CVERecord?id=CVE-2021-44228::



Notes: ::TYPE:Maintenance:NOTE:The interrelationships and differences between CWE-917 and CWE-1336 need to be further clarified.::TYPE:Relationship:NOTE:In certain versions of Spring 3.0.5 and earlier, there was a vulnerability (CVE-2011-2730) in which Expression Language tags would be evaluated twice, which effectively exposed any application to EL injection. However, even for later versions, this weakness is still possible depending on configuration.::
CWE-920: Improper Restriction of Power Consumption (Base)

Description: The product operates in an environment in which power is a limited resource that cannot be automatically replenished, but the product does not properly restrict the amount of power that its operation consumes.

Extended Description: In environments such as embedded or mobile devices, power can be a limited resource such as a battery, which cannot be automatically replenished by the product itself, and the device might not always be directly attached to a reliable power source. If the product uses too much power too quickly, then this could cause the device (and subsequently, the product) to stop functioning until power is restored, or increase the financial burden on the device owner because of increased power costs. Normal operation of an application will consume power. However, in some cases, an attacker could cause the application to consume more power than intended, using components such as: Display CPU Disk I/O GPS Sound Microphone USB interface



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::TECHNOLOGY CLASS:Mobile:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::



Common Consequences: ::SCOPE:Availability:IMPACT:DoS: Resource Consumption (Other):IMPACT:DoS: Crash, Exit, or Restart:NOTE:The power source could be drained, causing the application - and the entire device - to cease functioning.::