alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection). The product does not adequately filter user-controlled input for special elements with control implications.
CWE-76 Improper Neutralization of Equivalent Special Elements. The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection'). The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as <, >, and & that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CWE-81 Improper Neutralization of Script in an Error Message Web Page. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scripting elements when they are sent to an error page.
CWE-82 Improper Neutralization of Script in Attributes of IMG Tags in a Web Page. The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.
CWE-83 Improper Neutralization of Script in Attributes in a Web Page. The product does not neutralize or incorrectly neutralizes javascript: or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page. The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.
CWE-85 Doubled Character XSS Manipulations. The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.
CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages. The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.
CWE-87 Improper Neutralization of Alternate XSS Syntax. The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'). The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
CWE-91 XML Injection (aka Blind XPath Injection). The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection'). The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CWE-94 Improper Control of Generation of Code ('Code Injection'). The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. eval).
CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection'). The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.
CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page. The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.
CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'). The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in require, include, or similar functions.
CWE-99 Improper Control of Resource Identifiers ('Resource Injection'). The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
CWE-102 Struts: Duplicate Validation Forms. The product uses multiple validation forms with the same name, which might cause the Struts Validator to validate a form that the programmer does not expect.
CWE-103 Struts: Incomplete validate() Method Definition. The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().
CWE-104 Struts: Form Bean Does Not Extend Validation Class. If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.
CWE-105 Struts: Form Field Without Validator. The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.
CWE-106 Struts: Plug-in Framework not in Use. When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.
CWE-107 Struts: Unused Validation Form. An unused validation form indicates that validation logic is not up-to-date.
CWE-108 Struts: Unvalidated Action Form. Every Action Form must have a corresponding validation form.
CWE-109 Struts: Validator Turned Off. Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.
CWE-110 Struts: Validator Without Form Field. Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date.
CWE-111 Direct Use of Unsafe JNI. When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java.
CWE-112 Missing XML Validation. The product accepts XML from an untrusted source but does not validate the XML against the proper schema.
CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'). The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
CWE-114 Process Control. Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
CWE-115 Misinterpretation of Input. The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
CWE-116 Improper Encoding or Escaping of Output. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-117 Improper Output Neutralization for Logs. The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
CWE-118 Incorrect Access of Indexable Resource ('Range Error'). The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer. The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-121 Stack-based Buffer Overflow. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-122 Heap-based Buffer Overflow. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-123 Write-what-where Condition. Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
CWE-124 Buffer Underwrite ('Buffer Underflow'). The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
CWE-125 Out-of-bounds Read. The product reads data past the end, or before the beginning, of the intended buffer.
CWE-126 Buffer Over-read. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
CWE-127 Buffer Under-read. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.
CWE-128 Wrap-around Error. Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore wraps around to a very small, negative, or undefined value.
CWE-129 Improper Validation of Array Index. The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CWE-130 Improper Handling of Length Parameter Inconsistency. The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
CWE-131 Incorrect Calculation of Buffer Size. The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-134 Use of Externally-Controlled Format String. The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CWE-135 Incorrect Calculation of Multi-Byte String Length. The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
CWE-138 Improper Neutralization of Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
CWE-140 Improper Neutralization of Delimiters. The product does not neutralize or incorrectly neutralizes delimiters.
CWE-141 Improper Neutralization of Parameter/Argument Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.
CWE-142 Improper Neutralization of Value Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.
CWE-143 Improper Neutralization of Record Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.
CWE-144 Improper Neutralization of Line Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component.
CWE-145 Improper Neutralization of Section Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as section delimiters when they are sent to a downstream component.
CWE-146 Improper Neutralization of Expression/Command Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.
CWE-147 Improper Neutralization of Input Terminators. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.
CWE-148 Improper Neutralization of Input Leaders. The product does not properly handle when a leading character or sequence (leader) is missing or malformed, or if multiple leaders are used when only one should be allowed.
CWE-149 Improper Neutralization of Quoting Syntax. Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.
CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
CWE-151 Improper Neutralization of Comment Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment delimiters when they are sent to a downstream component.
CWE-152 Improper Neutralization of Macro Symbols. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as macro symbols when they are sent to a downstream component.
CWE-153 Improper Neutralization of Substitution Characters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as substitution characters when they are sent to a downstream component.
CWE-154 Improper Neutralization of Variable Name Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as variable name delimiters when they are sent to a downstream component.
CWE-155 Improper Neutralization of Wildcards or Matching Symbols. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.
CWE-156 Improper Neutralization of Whitespace. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as whitespace when they are sent to a downstream component.
CWE-157 Failure to Sanitize Paired Delimiters. The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.
CWE-158 Improper Neutralization of Null Byte or NUL Character. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.
CWE-159 Improper Handling of Invalid Use of Special Elements. The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity.
CWE-160 Improper Neutralization of Leading Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
CWE-161 Improper Neutralization of Multiple Leading Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
CWE-162 Improper Neutralization of Trailing Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
CWE-163 Improper Neutralization of Multiple Trailing Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
CWE-164 Improper Neutralization of Internal Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
CWE-165 Improper Neutralization of Multiple Internal Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
CWE-166 Improper Handling of Missing Special Element. The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.
CWE-167 Improper Handling of Additional Special Element. The product receives input from an upstream component, but it does not handle or incorrectly handles when an additional unexpected special element is provided.
CWE-168 Improper Handling of Inconsistent Special Elements. The product does not properly handle input in which an inconsistency exists between two or more special characters or reserved words.
CWE-170 Improper Null Termination. The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
CWE-172 Encoding Error. The product does not properly encode or decode the data, resulting in unexpected values.
CWE-173 Improper Handling of Alternate Encoding. The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.
CWE-174 Double Decoding of the Same Data. The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.
CWE-175 Improper Handling of Mixed Encoding. The product does not properly handle when the same input uses several different (mixed) encodings.
CWE-176 Improper Handling of Unicode Encoding. The product does not properly handle when an input contains Unicode encoding.
CWE-177 Improper Handling of URL Encoding (Hex Encoding). The product does not properly handle when all or part of an input has been URL encoded.
CWE-178 Improper Handling of Case Sensitivity. The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
CWE-179 Incorrect Behavior Order: Early Validation. The product validates input before applying protection mechanisms that modify the input, which could allow an attacker to bypass the validation via dangerous inputs that only arise after the modification.
CWE-180 Incorrect Behavior Order: Validate Before Canonicalize. The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
CWE-181 Incorrect Behavior Order: Validate Before Filter. The product validates data before it has been filtered, which prevents the product from detecting data that becomes invalid after the filtering step.
CWE-182 Collapse of Data into Unsafe Value. The product filters data in a way that causes it to be reduced or collapsed into an unsafe value that violates an expected security property.
CWE-183 Permissive List of Allowed Inputs. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.