alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
CWE-326 Inadequate Encryption Strength. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CWE-327 Use of a Broken or Risky Cryptographic Algorithm. The product uses a broken or risky cryptographic algorithm or protocol.
CWE-328 Use of Weak Hash. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
CWE-329 Generation of Predictable IV with CBC Mode. The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
CWE-330 Use of Insufficiently Random Values. The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CWE-331 Insufficient Entropy. The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
CWE-332 Insufficient Entropy in PRNG. The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.
CWE-333 Improper Handling of Insufficient Entropy in TRNG. True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
CWE-334 Small Space of Random Values. The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG). The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG). A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG). A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
CWE-339 Small Seed Space in PRNG. A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute force attacks.
CWE-340 Generation of Predictable Numbers or Identifiers. The product uses a scheme that generates numbers or identifiers that are more predictable than required.
CWE-341 Predictable from Observable State. A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
CWE-342 Predictable Exact Value from Previous Values. An exact value or random number can be precisely predicted by observing previous values.
CWE-343 Predictable Value Range from Previous Values. The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated.
CWE-344 Use of Invariant Value in Dynamically Changing Context. The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
CWE-345 Insufficient Verification of Data Authenticity. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-346 Origin Validation Error. The product does not properly verify that the source of data or communication is valid.
CWE-347 Improper Verification of Cryptographic Signature. The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-348 Use of Less Trusted Source. The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data. The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action. The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
CWE-351 Insufficient Type Distinction. The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.
CWE-352 Cross-Site Request Forgery (CSRF). The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-353 Missing Support for Integrity Check. The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
CWE-354 Improper Validation of Integrity Check Value. The product does not validate or incorrectly validates the integrity check values or checksums of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
CWE-356 Product UI does not Warn User of Unsafe Actions. The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system.
CWE-357 Insufficient UI Warning of Dangerous Operations. The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.
CWE-358 Improperly Implemented Security Check for Standard. The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
CWE-359 Exposure of Private Personal Information to an Unauthorized Actor. The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CWE-360 Trust of System Event Data. Security based on event locations are insecure and can be spoofed.
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-363 Race Condition Enabling Link Following. The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.
CWE-364 Signal Handler Race Condition. The product uses a signal handler that introduces a race condition.
CWE-366 Race Condition within a Thread. If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-368 Context Switching Race Condition. A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product's behavior during the switch.
CWE-370 Missing Check for Certificate Revocation after Initial Check. The product does not check the revocation status of a certificate after its initial revocation check, which can cause the product to perform privileged actions even after the certificate is revoked at a later time.
CWE-372 Incomplete Internal State Distinction. The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.
CWE-374 Passing Mutable Objects to an Untrusted Method. The product sends non-cloned mutable data as an argument to a method or function.
CWE-375 Returning a Mutable Object to an Untrusted Caller. Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
CWE-377 Insecure Temporary File. Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CWE-378 Creation of Temporary File With Insecure Permissions. Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
CWE-379 Creation of Temporary File in Directory with Insecure Permissions. The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
CWE-382 J2EE Bad Practices: Use of System.exit(). A J2EE application uses System.exit(), which also shuts down its container.
CWE-383 J2EE Bad Practices: Direct Use of Threads. Thread management in a Web application is forbidden in some circumstances and is always highly error prone.
CWE-384 Session Fixation. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CWE-385 Covert Timing Channel. Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
CWE-386 Symbolic Name not Mapping to Correct Object. A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.
CWE-390 Detection of Error Condition Without Action. The product detects a specific error, but takes no actions to handle the error.
CWE-391 Unchecked Error Condition. [PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
CWE-392 Missing Report of Error Condition. The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.
CWE-393 Return of Wrong Status Code. A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.
CWE-394 Unexpected Status Code or Return Value. The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
CWE-395 Use of NullPointerException Catch to Detect NULL Pointer Dereference. Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.
CWE-396 Declaration of Catch for Generic Exception. Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
CWE-397 Declaration of Throws for Generic Exception. The product throws or raises an overly broad exceptions that can hide important details and produce inappropriate responses to certain conditions.
CWE-400 Uncontrolled Resource Consumption. The product does not properly control the allocation and maintenance of a limited resource.
CWE-401 Missing Release of Memory after Effective Lifetime. The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak'). The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
CWE-403 Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak'). A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.
CWE-404 Improper Resource Shutdown or Release. The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-405 Asymmetric Resource Consumption (Amplification). The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is asymmetric.
CWE-406 Insufficient Control of Network Message Volume (Network Amplification). The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
CWE-407 Inefficient Algorithmic Complexity. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-408 Incorrect Behavior Order: Early Amplification. The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.
CWE-409 Improper Handling of Highly Compressed Data (Data Amplification). The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
CWE-410 Insufficient Resource Pool. The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
CWE-412 Unrestricted Externally Accessible Lock. The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.
CWE-413 Improper Resource Locking. The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
CWE-414 Missing Lock Check. A product does not check to see if a lock is present before performing sensitive operations on a resource.
CWE-415 Double Free. The product calls free() twice on the same memory address.
CWE-416 Use After Free. The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
CWE-419 Unprotected Primary Channel. The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.
CWE-420 Unprotected Alternate Channel. The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
CWE-421 Race Condition During Access to Alternate Channel. The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors.
CWE-422 Unprotected Windows Messaging Channel ('Shatter'). The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.
CWE-424 Improper Protection of Alternate Path. The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
CWE-425 Direct Request ('Forced Browsing'). The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
CWE-426 Untrusted Search Path. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CWE-427 Uncontrolled Search Path Element. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CWE-428 Unquoted Search Path or Element. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
CWE-430 Deployment of Wrong Handler. The wrong handler is assigned to process an object.
CWE-432 Dangerous Signal Handler not Disabled During Sensitive Operations. The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running.
CWE-433 Unparsed Raw Web Content Delivery. The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.
CWE-434 Unrestricted Upload of File with Dangerous Type. The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-435 Improper Interaction Between Multiple Correctly-Behaving Entities. An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.
CWE-436 Interpretation Conflict. Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
CWE-437 Incomplete Model of Endpoint Features. A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model.
CWE-439 Behavioral Change in New Version or Environment. A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.
CWE-440 Expected Behavior Violation. A feature, API, or function does not perform according to its specification.
CWE-441 Unintended Proxy or Intermediary ('Confused Deputy'). The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'). The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
CWE-446 UI Discrepancy for Security Feature. The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.
CWE-447 Unimplemented or Unsupported Feature in UI. A UI function for a security feature appears to be supported and gives feedback to the user that suggests that it is supported, but the underlying functionality is not implemented.
CWE-448 Obsolete Feature in UI. A UI function is obsolete and the product does not warn the user.
CWE-449 The UI Performs the Wrong Action. The UI performs the wrong action with respect to the user's request.
CWE-450 Multiple Interpretations of UI Input. The UI has multiple interpretations of user input but does not prompt the user when it selects the less secure interpretation.
CWE-451 User Interface (UI) Misrepresentation of Critical Information. The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
CWE-453 Insecure Default Variable Initialization. The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
CWE-454 External Initialization of Trusted Variables or Data Stores. The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.
CWE-455 Non-exit on Failed Initialization. The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.
CWE-456 Missing Initialization of a Variable. The product does not initialize critical variables, which causes the execution environment to use unexpected values.
CWE-457 Use of Uninitialized Variable. The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-459 Incomplete Cleanup. The product does not properly clean up and remove temporary or supporting resources after they have been used.
CWE-460 Improper Cleanup on Thrown Exception. The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
CWE-462 Duplicate Key in Associative List (Alist). Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error.
CWE-463 Deletion of Data Structure Sentinel. The accidental deletion of a data-structure sentinel can cause serious programming logic problems.
CWE-464 Addition of Data Structure Sentinel. The accidental addition of a data-structure sentinel can cause serious programming logic problems.
CWE-466 Return of Pointer Value Outside of Expected Range. A function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference.
CWE-467 Use of sizeof() on a Pointer Type. The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to.
CWE-468 Incorrect Pointer Scaling. In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
CWE-469 Use of Pointer Subtraction to Determine Size. The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'). The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
CWE-471 Modification of Assumed-Immutable Data (MAID). The product does not properly protect an assumed-immutable element from being modified by an attacker.