Krutikp/ComplianceLLM huggingface dataset:
CWE-1335: Incorrect Bitwise Shift of Integer (Base)

Description: An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.

Extended Description: Specifying a value to be shifted by a negative amount is undefined in various languages. Various computer architectures implement this action in different ways. The compilers and interpreters when generating code to accomplish a shift generally do not do a check for this issue. Specifying an over-shift, a shift greater than or equal to the number of bits contained in a value to be shifted, produces a result which varies by architecture and compiler. In some languages, this action is specifically listed as producing an undefined result.



Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C#:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:JavaScript:LANGUAGE PREVALENCE:Undetermined::OPERATING SYSTEM CLASS:Not OS-Specific:OPERATING SYSTEM PREVALENCE:Undetermined::TECHNOLOGY CLASS:Not Technology-Specific:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:Adding shifts without properly verifying the size and sign of the shift amount.::



Common Consequences: ::SCOPE:Integrity:IMPACT:DoS: Crash, Exit, or Restart::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Implicitly or explicitly add checks and mitigation for negative or over-shift values.::

Observed Examples: ::REFERENCE:CVE-2009-4307:DESCRIPTION:An unexpected large value in the ext4 filesystem causes an overshift condition resulting in a divide by zero.:LINK:https://www.cve.org/CVERecord?id=CVE-2009-4307::REFERENCE:CVE-2012-2100:DESCRIPTION:An unexpected large value in the ext4 filesystem causes an overshift condition resulting in a divide by zero - fix of CVE-2009-4307.:LINK:https://www.cve.org/CVERecord?id=CVE-2012-2100::REFERENCE:CVE-2020-8835:DESCRIPTION:An overshift in a kernel allowed out of bounds reads and writes resulting in a root takeover.:LINK:https://www.cve.org/CVERecord?id=CVE-2020-8835::REFERENCE:CVE-2015-1607:DESCRIPTION:Program is not properly handling signed bitwise left-shifts causing an overlapping memcpy memory range error.:LINK:https://www.cve.org/CVERecord?id=CVE-2015-1607::REFERENCE:CVE-2016-9842:DESCRIPTION:Compression function improperly executes a signed left shift of a negative integer.:LINK:https://www.cve.org/CVERecord?id=CVE-2016-9842::REFERENCE:CVE-2018-18445:DESCRIPTION:Some kernels improperly handle right shifts of 32 bit numbers in a 64 bit register.:LINK:https://www.cve.org/CVERecord?id=CVE-2018-18445::REFERENCE:CVE-2013-4206:DESCRIPTION:Putty has an incorrectly sized shift value resulting in an overshift.:LINK:https://www.cve.org/CVERecord?id=CVE-2013-4206::REFERENCE:CVE-2018-20788:DESCRIPTION:LED driver overshifts under certain conditions resulting in a DoS.:LINK:https://www.cve.org/CVERecord?id=CVE-2018-20788::
CWE-1392: Use of Default Credentials (Base)

Description: The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Extended Description: It is common practice for products to be designed to use default keys, passwords, or other mechanisms for authentication. The rationale is to simplify the manufacturing process or the system administrator's task of installation and deployment into an enterprise. However, if admins do not change the defaults, it is easier for attackers to bypass authentication quickly across multiple organizations.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::OPERATING SYSTEM CLASS:Not OS-Specific:OPERATING SYSTEM PREVALENCE:Undetermined::ARCHITECTURE CLASS:Not Architecture-Specific:ARCHITECTURE PREVALENCE:Undetermined::TECHNOLOGY CLASS:ICS/OT:TECHNOLOGY PREVALENCE:Undetermined::TECHNOLOGY CLASS:Not Technology-Specific:TECHNOLOGY PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::



Common Consequences: ::SCOPE:Authentication:IMPACT:Gain Privileges or Assume Identity::


Potential Mitigations: ::PHASE:Requirements:DESCRIPTION:Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.:EFFECTIVENESS:High::PHASE:Architecture and Design:DESCRIPTION:Force the administrator to change the credential upon installation.:EFFECTIVENESS:High::PHASE:Installation Operation:DESCRIPTION:The product administrator could change the defaults upon installation or during operation.:EFFECTIVENESS:Moderate::

Observed Examples: ::REFERENCE:CVE-2022-30270:DESCRIPTION:Remote Terminal Unit (RTU) uses default credentials for some SSH accounts:LINK:https://www.cve.org/CVERecord?id=CVE-2022-30270::REFERENCE:CVE-2021-41192:DESCRIPTION:data visualization/sharing package uses default secret keys or cookie values if they are not specified in environment variables:LINK:https://www.cve.org/CVERecord?id=CVE-2021-41192::REFERENCE:CVE-2021-38759:DESCRIPTION:microcontroller board has default password:LINK:https://www.cve.org/CVERecord?id=CVE-2021-38759::REFERENCE:CVE-2010-2306:DESCRIPTION:Intrusion Detection System (IDS) uses the same static, private SSL keys for multiple devices and installations, allowing decryption of SSL traffic:LINK:https://www.cve.org/CVERecord?id=CVE-2010-2306::