alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
CWE-1079 Parent Class without Virtual Destructor Method. A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.
CWE-1080 Source Code File with Excessive Number of Lines of Code. A source code file has too many lines of code.
CWE-1082 Class Instance Self Destruction Control Element. The code contains a class instance that calls the method or function to delete or destroy itself.
CWE-1083 Data Access from Outside Expected Data Manager Component. The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component.
CWE-1084 Invokable Control Element with Excessive File or Data Access Operations. A function or method contains too many operations that utilize a data manager or file resource.
CWE-1085 Invokable Control Element with Excessive Volume of Commented-out Code. A function, method, procedure, etc. contains an excessive amount of code that has been commented out within its body.
CWE-1086 Class with Excessive Number of Child Classes. A class contains an unnecessarily large number of children.
CWE-1087 Class with Virtual Method without a Virtual Destructor. A class contains a virtual method, but the method does not have an associated virtual destructor.
CWE-1088 Synchronous Access of Remote Resource without Timeout. The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.
CWE-1089 Large Data Table with Excessive Number of Indices. The product uses a large data table that contains an excessively large number of indices.
CWE-1090 Method Containing Access of a Member Element from Another Class. A method for a class performs an operation that directly accesses a member element from another class.
CWE-1091 Use of Object without Invoking Destructor Method. The product contains a method that accesses an object but does not later invoke the element's associated finalize/destructor method.
CWE-1092 Use of Same Invokable Control Element in Multiple Architectural Layers. The product uses the same control element across multiple architectural layers.
CWE-1093 Excessively Complex Data Representation. The product uses an unnecessarily complex internal representation for its data structures or interrelationships between those structures.
CWE-1094 Excessive Index Range Scan for a Data Resource. The product contains an index range scan for a large data table, but the scan can cover a large number of rows.
CWE-1095 Loop Condition Value Update within the Loop. The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.
CWE-1096 Singleton Class Instance Creation without Proper Locking or Synchronization. The product implements a Singleton design pattern but does not use appropriate locking or other synchronization mechanism to ensure that the singleton class is only instantiated once.
CWE-1097 Persistent Storable Data Element without Associated Comparison Control Element. The product uses a storable data element that does not have all of the associated functions or methods that are necessary to support comparison.
CWE-1098 Data Element containing Pointer Item without Proper Copy Control Element. The code contains a data element with a pointer that does not have an associated copy or constructor method.
CWE-1099 Inconsistent Naming Conventions for Identifiers. The product's code, documentation, or other artifacts do not consistently use the same naming conventions for variables, callables, groups of related callables, I/O capabilities, data types, file names, or similar types of elements.
CWE-1100 Insufficient Isolation of System-Dependent Functions. The product or code does not isolate system-dependent functionality into separate standalone modules.
CWE-1101 Reliance on Runtime Component in Generated Code. The product uses automatically-generated code that cannot be executed without a specific runtime support component.
CWE-1102 Reliance on Machine-Dependent Data Representation. The code uses a data representation that relies on low-level data representation or constructs that may vary across different processors, physical machines, OSes, or other physical components.
CWE-1103 Use of Platform-Dependent Third Party Components. The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.
CWE-1104 Use of Unmaintained Third Party Components. The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.
CWE-1105 Insufficient Encapsulation of Machine-Dependent Functionality. The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the rest of the code.
CWE-1106 Insufficient Use of Symbolic Constants. The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.
CWE-1107 Insufficient Isolation of Symbolic Constant Definitions. The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or isolated location.
CWE-1108 Excessive Reliance on Global Variables. The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context.
CWE-1109 Use of Same Variable for Multiple Purposes. The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.
CWE-1110 Incomplete Design Documentation. The product's design documentation does not adequately describe control flow, data flow, system initialization, relationships between tasks, components, rationales, or other important aspects of the design.
CWE-1111 Incomplete I/O Documentation. The product's documentation does not adequately define inputs, outputs, or system/software interfaces.
CWE-1112 Incomplete Documentation of Program Execution. The document does not fully define all mechanisms that are used to control or influence how product-specific programs are executed.
CWE-1113 Inappropriate Comment Style. The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.
CWE-1114 Inappropriate Whitespace Style. The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.
CWE-1115 Source Code Element without Standard Prologue. The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized for the project.
CWE-1116 Inaccurate Source Code Comments. The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.
CWE-1117 Callable with Insufficient Behavioral Summary. The code contains a function or method whose signature and/or associated inline documentation does not sufficiently describe the callable's inputs, outputs, side effects, assumptions, or return codes.
CWE-1118 Insufficient Documentation of Error Handling Techniques. The documentation does not sufficiently describe the techniques that are used for error handling, exception processing, or similar mechanisms.
CWE-1119 Excessive Use of Unconditional Branching. The code uses too many unconditional branches (such as goto).
CWE-1120 Excessive Code Complexity. The code is too complex, as calculated using a well-defined, quantitative measure.
CWE-1121 Excessive McCabe Cyclomatic Complexity. The code contains McCabe cyclomatic complexity that exceeds a desirable maximum.
CWE-1122 Excessive Halstead Complexity. The code is structured in a way that a Halstead complexity measure exceeds a desirable maximum.
CWE-1123 Excessive Use of Self-Modifying Code. The product uses too much self-modifying code.
CWE-1124 Excessively Deep Nesting. The code contains a callable or other code grouping in which the nesting / branching is too deep.
CWE-1125 Excessive Attack Surface. The product has an attack surface whose quantitative measurement exceeds a desirable maximum.
CWE-1126 Declaration of Variable with Unnecessarily Wide Scope. The source code declares a variable in one scope, but the variable is only used within a narrower scope.
CWE-1127 Compilation with Insufficient Warnings or Errors. The code is compiled without sufficient warnings enabled, which may prevent the detection of subtle bugs or quality issues.
CWE-1164 Irrelevant Code. The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.
CWE-1173 Improper Use of Validation Framework. The product does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library.
CWE-1174 ASP.NET Misconfiguration: Improper Model Validation. The ASP.NET application does not use, or incorrectly uses, the model validation framework.
CWE-1176 Inefficient CPU Computation. The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further.
CWE-1177 Use of Prohibited Code. The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.
CWE-1188 Initialization of a Resource with an Insecure Default. The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-1189 Improper Isolation of Shared Resources on System-on-a-Chip (SoC). The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents.
CWE-1190 DMA Device Enabled Too Early in Boot Phase. The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product.
CWE-1191 On-Chip Debug and Test Interface With Improper Access Control. The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.
CWE-1192 Improper Identifier for IP Block used in System-On-Chip (SOC). The System-on-Chip (SoC) does not have unique, immutable identifiers for each of its components.
CWE-1193 Power-On of Untrusted Execution Core Before Enabling Fabric Access Control. The product enables components that contain untrusted firmware before memory and fabric access controls have been enabled.
CWE-1204 Generation of Weak Initialization Vector (IV). The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.
CWE-1209 Failure to Disable Reserved Bits. The reserved bits in a hardware design are not disabled prior to production. Typically, reserved bits are used for future capabilities and should not support any functional logic in the design. However, designers might covertly use these bits to debug or further develop new capabilities in production hardware. Adversaries with access to these bits will write to them in hopes of compromising hardware state.
CWE-1220 Insufficient Granularity of Access Control. The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
CWE-1221 Incorrect Register Defaults or Module Parameters. Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values.
CWE-1222 Insufficient Granularity of Address Regions Protected by Register Locks. The product defines a large address region protected from modification by the same register lock control bit. This results in a conflict between the functional requirement that some addresses need to be writable by software during operation and the security requirement that the system configuration lock bit must be set during the boot process.
CWE-1223 Race Condition for Write-Once Attributes. A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted software component, resulting in a race condition issue.
CWE-1224 Improper Restriction of Write-Once Bit Fields. The hardware design control register sticky bits or write-once bit fields are improperly implemented, such that they can be reprogrammed by software.
CWE-1229 Creation of Emergent Resource. The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy.
CWE-1230 Exposure of Sensitive Information Through Metadata. The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.
CWE-1231 Improper Prevention of Lock Bit Modification. The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the value of the lock bit from being modified after it has been set.
CWE-1232 Improper Lock Behavior After Power State Transition. Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected registers or lock bits become programmable after power state transitions (e.g., Entry and wake from low power sleep modes) causing the system configuration to be changeable.
CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection. The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents modification of system registers or controls that perform changes to important hardware system configuration.
CWE-1234 Hardware Internal or Debug Modes Allow Override of Locks. System configuration protection may be bypassed during debug mode.
CWE-1235 Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations. The code uses boxed primitives, which may introduce inefficiencies into performance-critical operations.
CWE-1236 Improper Neutralization of Formula Elements in a CSV File. The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CWE-1239 Improper Zeroization of Hardware Register. The hardware product does not properly clear sensitive information from built-in registers when the user of the hardware block changes.
CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation. To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
CWE-1241 Use of Predictable Algorithm in Random Number Generator. The device uses an algorithm that is predictable and generates a pseudo-random number.
CWE-1242 Inclusion of Undocumented Features or Chicken Bits. The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.
CWE-1243 Sensitive Non-Volatile Information Not Protected During Debug. Access to security-sensitive information stored in fuses is not limited during debug.
CWE-1244 Internal Asset Exposed to Unsafe Debug Access Level or State. The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.
CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic. Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system.
CWE-1246 Improper Write Handling in Limited-write Non-Volatile Memories. The product does not implement or incorrectly implements wear leveling operations in limited-write non-volatile memories.
CWE-1247 Improper Protection Against Voltage and Clock Glitches. The device does not contain or contains incorrectly implemented circuitry or sensors to detect and mitigate voltage and clock glitches and protect sensitive information or software contained on the device.
CWE-1248 Semiconductor Defects in Hardware Logic with Security-Sensitive Implications. The security-sensitive hardware module contains semiconductor defects.
CWE-1249 Application-Level Admin Tool with Inconsistent View of Underlying Operating System. The product provides an application for administrators to manage parts of the underlying operating system, but the application does not accurately identify all of the relevant entities or resources that exist in the OS; that is, the application's model of the OS's state is inconsistent with the OS's actual state.
CWE-1250 Improper Preservation of Consistency Between Independent Representations of Shared State. The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.
CWE-1251 Mirrored Regions with Different Values. The product's architecture mirrors regions without ensuring that their contents always stay in sync.
CWE-1252 CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations. The CPU is not configured to provide hardware support for exclusivity of write and execute operations on memory. This allows an attacker to execute data from all of memory.
CWE-1253 Incorrect Selection of Fuse Values. The logic level used to set a system to a secure state relies on a fuse being unblown.
CWE-1254 Incorrect Comparison Logic Granularity. The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.
CWE-1255 Comparison Logic is Vulnerable to Power Side-Channel Attacks. A device's real time power consumption may be monitored during security token evaluation and the information gleaned may be used to determine the value of the reference token.
CWE-1256 Improper Restriction of Software Interfaces to Hardware Features. The product provides software-controllable device functionality for capabilities such as power and clock management, but it does not properly limit functionality that can lead to modification of hardware memory or register bits, or the ability to observe physical side channels.
CWE-1257 Improper Access Control Applied to Mirrored or Aliased Memory Regions. Aliased or mirrored memory regions in hardware designs may have inconsistent read/write permissions enforced by the hardware. A possible result is that an untrusted agent is blocked from accessing a memory region but is not blocked from accessing the corresponding aliased memory region.
CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information. The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered.
CWE-1259 Improper Restriction of Security Token Assignment. The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.
CWE-1260 Improper Handling of Overlap Between Protected Memory Ranges. The product allows address regions to overlap, which can result in the bypassing of intended memory protection.
CWE-1261 Improper Handling of Single Event Upsets. The hardware logic does not effectively handle when single-event upsets (SEUs) occur.
CWE-1262 Improper Access Control for Register Interface. The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers.
CWE-1263 Improper Physical Access Control. The product is designed with access restricted to certain information, but it does not sufficiently protect against an unauthorized actor with physical access to these areas.
CWE-1264 Hardware Logic with Insecure De-Synchronization between Control and Data Channels. The hardware logic for error handling and security checks can incorrectly forward data before the security check is complete.
CWE-1265 Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls. The product invokes code that is believed to be reentrant, but the code performs a call that unintentionally produces a nested invocation of the non-reentrant code.
CWE-1266 Improper Scrubbing of Sensitive Data from Decommissioned Device. The product does not properly provide a capability for the product administrator to remove sensitive data at the time the product is decommissioned. A scrubbing capability could be missing, insufficient, or incorrect.
CWE-1267 Policy Uses Obsolete Encoding. The product uses an obsolete encoding mechanism to implement access controls.
CWE-1268 Policy Privileges are not Assigned Consistently Between Control and Data Agents. The product's hardware-enforced access control for a particular resource improperly accounts for privilege discrepancies between control and write policies.
CWE-1269 Product Released in Non-Release Configuration. The product released to market is released in pre-production or manufacturing configuration.
CWE-1270 Generation of Incorrect Security Tokens. The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.
CWE-1271 Uninitialized Value on Reset for Registers Holding Security Settings. Security-critical logic is not set to a known value on reset.
CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition. The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.
CWE-1273 Device Unlock Credential Sharing. The credentials necessary for unlocking a device are shared across multiple parties and may expose sensitive information.
CWE-1274 Improper Access Control for Volatile Memory Containing Boot Code. The product conducts a secure-boot process that transfers bootloader code from Non-Volatile Memory (NVM) into Volatile Memory (VM), but it does not have sufficient access control or other protections for the Volatile Memory.
CWE-1275 Sensitive Cookie with Improper SameSite Attribute. The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
CWE-1276 Hardware Child Block Incorrectly Connected to Parent System. Signals between a hardware IP and the parent system design are incorrectly connected causing security risks.
CWE-1277 Firmware Not Updateable. The product does not provide its users with the ability to update or patch its firmware to address any vulnerabilities or weaknesses that may be present.