alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
CWE-790 Improper Filtering of Special Elements. The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.
CWE-791 Incomplete Filtering of Special Elements. The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
CWE-792 Incomplete Filtering of One or More Instances of Special Elements. The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.
CWE-793 Only Filtering One Instance of a Special Element. The product receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component.
CWE-794 Incomplete Filtering of Multiple Instances of Special Elements. The product receives data from an upstream component, but does not filter all instances of a special element before sending it to a downstream component.
CWE-795 Only Filtering Special Elements at a Specified Location. The product receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component.
CWE-796 Only Filtering Special Elements Relative to a Marker. The product receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. at the beginning/end of a string; the second argument), thereby missing remaining special elements that may exist before sending it to a downstream component.
CWE-797 Only Filtering Special Elements at an Absolute Position. The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. byte number 10), thereby missing remaining special elements that may exist before sending it to a downstream component.
CWE-798 Use of Hard-coded Credentials. The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-799 Improper Control of Interaction Frequency. The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
CWE-804 Guessable CAPTCHA. The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
CWE-805 Buffer Access with Incorrect Length Value. The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
CWE-806 Buffer Access Using Size of Source Buffer. The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.
CWE-807 Reliance on Untrusted Inputs in a Security Decision. The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CWE-820 Missing Synchronization. The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
CWE-821 Incorrect Synchronization. The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.
CWE-822 Untrusted Pointer Dereference. The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
CWE-823 Use of Out-of-range Pointer Offset. The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
CWE-824 Access of Uninitialized Pointer. The product accesses or uses a pointer that has not been initialized.
CWE-825 Expired Pointer Dereference. The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
CWE-826 Premature Release of Resource During Expected Lifetime. The product releases a resource that is still intended to be used by itself or another actor.
CWE-827 Improper Control of Document Type Definition. The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
CWE-828 Signal Handler with Functionality that is not Asynchronous-Safe. The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the functionality is not reentrant, or it can be interrupted.
CWE-829 Inclusion of Functionality from Untrusted Control Sphere. The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-830 Inclusion of Web Functionality from an Untrusted Source. The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
CWE-831 Signal Handler Function Associated with Multiple Signals. The product defines a function that is used as a handler for more than one signal.
CWE-832 Unlock of a Resource that is not Locked. The product attempts to unlock a resource that is not locked.
CWE-833 Deadlock. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
CWE-834 Excessive Iteration. The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop'). The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-836 Use of Password Hash Instead of Password for Authentication. The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.
CWE-837 Improper Enforcement of a Single, Unique Action. The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.
CWE-838 Inappropriate Encoding for Output Context. The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
CWE-839 Numeric Range Comparison Without Minimum Check. The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
CWE-841 Improper Enforcement of Behavioral Workflow. The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
CWE-842 Placement of User into Incorrect Group. The product or the administrator places a user into an incorrect group.
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion'). The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CWE-862 Missing Authorization. The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 Incorrect Authorization. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-908 Use of Uninitialized Resource. The product uses or accesses a resource that has not been initialized.
CWE-909 Missing Initialization of Resource. The product does not initialize a critical resource.
CWE-910 Use of Expired File Descriptor. The product uses or accesses a file descriptor after it has been closed.
CWE-911 Improper Update of Reference Count. The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.
CWE-912 Hidden Functionality. The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.
CWE-913 Improper Control of Dynamically-Managed Code Resources. The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
CWE-914 Improper Control of Dynamically-Identified Variables. The product does not properly restrict reading from or writing to dynamically-identified variables.
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CWE-916 Use of Password Hash With Insufficient Computational Effort. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'). The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
CWE-918 Server-Side Request Forgery (SSRF). The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-920 Improper Restriction of Power Consumption. The product operates in an environment in which power is a limited resource that cannot be automatically replenished, but the product does not properly restrict the amount of power that its operation consumes.
CWE-921 Storage of Sensitive Data in a Mechanism without Access Control. The product stores sensitive information in a file system or device that does not have built-in access control.
CWE-922 Insecure Storage of Sensitive Information. The product stores sensitive information without properly limiting read or write access by unauthorized actors.
CWE-923 Improper Restriction of Communication Channel to Intended Endpoints. The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel. The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.
CWE-925 Improper Verification of Intent by Broadcast Receiver. The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.
CWE-926 Improper Export of Android Application Components. The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
CWE-927 Use of Implicit Intent for Sensitive Communication. The Android application uses an implicit intent for transmitting sensitive data to other applications.
CWE-939 Improper Authorization in Handler for Custom URL Scheme. The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
CWE-940 Improper Verification of Source of a Communication Channel. The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
CWE-941 Incorrectly Specified Destination in a Communication Channel. The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.
CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains. The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
CWE-943 Improper Neutralization of Special Elements in Data Query Logic. The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag. The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
CWE-1007 Insufficient Visual Distinction of Homoglyphs Presented to User. The product displays information or identifiers to a user, but the display mechanism does not make it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which may cause the user to misinterpret a glyph and perform an unintended, insecure action.
CWE-1021 Improper Restriction of Rendered UI Layers or Frames. The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
CWE-1022 Use of Web Link to Untrusted Target with window.opener Access. The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.
CWE-1023 Incomplete Comparison with Missing Factors. The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.
CWE-1024 Comparison of Incompatible Types. The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared.
CWE-1025 Comparison Using Wrong Factors. The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.
CWE-1037 Processor Optimization Removal or Modification of Security-critical Code. The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.
CWE-1038 Insecure Automated Optimizations. The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.
CWE-1039 Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism. The product uses an automated mechanism such as machine learning to recognize complex data inputs (e.g. image or audio) as a particular concept or category, but it does not properly detect or handle inputs that have been modified or constructed in a way that causes the mechanism to detect a different, incorrect concept.
CWE-1041 Use of Redundant Code. The product has multiple functions, methods, procedures, macros, etc. that contain the same code.
CWE-1042 Static Member Data Element outside of a Singleton Class Element. The code contains a member element that is declared as static (but not final), in which its parent class element is not a singleton class - that is, a class element that can be used only once in the 'to' association of a Create action.
CWE-1043 Data Element Aggregating an Excessively Large Number of Non-Primitive Elements. The product uses a data element that has an excessively large number of sub-elements with non-primitive data types such as structures or aggregated objects.
CWE-1044 Architecture with Number of Horizontal Layers Outside of Expected Range. The product's architecture contains too many - or too few - horizontal layers.
CWE-1045 Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor. A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.
CWE-1046 Creation of Immutable Text Using String Concatenation. The product creates an immutable text string using string concatenation operations.
CWE-1047 Modules with Circular Dependencies. The product contains modules in which one module has references that cycle back to itself, i.e., there are circular dependencies.
CWE-1048 Invokable Control Element with Large Number of Outward Calls. The code contains callable control elements that contain an excessively large number of references to other application objects external to the context of the callable, i.e. a Fan-Out value that is excessively large.
CWE-1049 Excessive Data Query Operations in a Large Data Table. The product performs a data query with a large number of joins and sub-queries on a large data table.
CWE-1050 Excessive Platform Resource Consumption within a Loop. The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
CWE-1051 Initialization with Hard-Coded Network Resource Configuration Data. The product initializes data using hard-coded values that act as network resource identifiers.
CWE-1052 Excessive Use of Hard-Coded Literals in Initialization. The product initializes a data element using a hard-coded literal that is not a simple integer or static constant element.
CWE-1053 Missing Documentation for Design. The product does not have documentation that represents how it is designed.
CWE-1054 Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer. The code at one architectural layer invokes code that resides at a deeper layer than the adjacent layer, i.e., the invocation skips at least one layer, and the invoked code is not part of a vertical utility layer that can be referenced from any horizontal layer.
CWE-1055 Multiple Inheritance from Concrete Classes. The product contains a class with inheritance from more than one concrete class.
CWE-1056 Invokable Control Element with Variadic Parameters. A named-callable or method control element has a signature that supports a variable (variadic) number of parameters or arguments.
CWE-1057 Data Access Operations Outside of Expected Data Manager Component. The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager.
CWE-1058 Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element. The code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final static storable or member data element.
CWE-1059 Insufficient Technical Documentation. The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.
CWE-1060 Excessive Number of Inefficient Server-Side Data Accesses. The product performs too many data queries without using efficient data processing functionality such as stored procedures.
CWE-1061 Insufficient Encapsulation. The product does not sufficiently hide the internal representation and implementation details of data or methods, which might allow external components or modules to modify data unexpectedly, invoke unexpected functionality, or introduce dependencies that the programmer did not intend.
CWE-1062 Parent Class with References to Child Class. The code has a parent class that contains references to a child class, its methods, or its members.
CWE-1063 Creation of Class Instance within a Static Code Block. A static code block creates an instance of a class.
CWE-1064 Invokable Control Element with Signature Containing an Excessive Number of Parameters. The product contains a function, subroutine, or method whose signature has an unnecessarily large number of parameters/arguments.
CWE-1065 Runtime Resource Management Control Element in a Component Built to Run on Application Servers. The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server.
CWE-1066 Missing Serialization Control Element. The product contains a serializable data element that does not have an associated serialization method.
CWE-1067 Excessive Execution of Sequential Searches of Data Resource. The product contains a data query against an SQL table or view that is configured in a way that does not utilize an index and may cause sequential searches to be performed.
CWE-1068 Inconsistency Between Implementation and Documented Design. The implementation of the product is not consistent with the design as described within the relevant documentation.
CWE-1069 Empty Exception Block. An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.
CWE-1070 Serializable Data Element Containing non-Serializable Item Elements. The product contains a serializable, storable data element such as a field or member, but the data element contains member elements that are not serializable.
CWE-1071 Empty Code Block. The source code contains a block that does not contain any code, i.e., the block is empty.
CWE-1072 Data Resource Access without Use of Connection Pooling. The product accesses a data resource through a database without using a connection pooling capability.
CWE-1073 Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses. The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities.
CWE-1074 Class with Excessively Deep Inheritance. A class has an inheritance level that is too high, i.e., it has a large number of parent classes.
CWE-1075 Unconditional Control Flow Transfer outside of Switch Block. The product performs unconditional control transfer (such as a goto) in code outside of a branching structure such as a switch block.
CWE-1076 Insufficient Adherence to Expected Conventions. The product's architecture, source code, design, documentation, or other artifact does not follow required conventions.
CWE-1077 Floating Point Comparison with Incorrect Operator. The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.
CWE-1078 Inappropriate Source Code Style or Formatting. The source code does not follow desired style or formatting for indentation, white space, comments, etc.