alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
CWE-621 Variable Extraction Error. The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables.
CWE-622 Improper Validation of Function Hook Arguments. The product adds hooks to user-accessible API functions, but it does not properly validate the arguments. This could lead to resultant vulnerabilities.
CWE-623 Unsafe ActiveX Control Marked Safe For Scripting. An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.
CWE-624 Executable Regular Expression Error. The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.
CWE-625 Permissive Regular Expression. The product uses a regular expression that does not sufficiently restrict the set of allowed values.
CWE-626 Null Byte Interaction Error (Poison Null Byte). The product does not properly handle null bytes or NUL characters when passing data between different representations or components.
CWE-627 Dynamic Variable Evaluation. In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
CWE-628 Function Call with Incorrectly Specified Arguments. The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.
CWE-636 Not Failing Securely ('Failing Open'). When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
CWE-637 Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism'). The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used.
CWE-638 Not Using Complete Mediation. The product does not perform access checks on a resource every time the resource is accessed by an entity, which can create resultant weaknesses if that entity's rights or privileges change over time.
CWE-639 Authorization Bypass Through User-Controlled Key. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-640 Weak Password Recovery Mechanism for Forgotten Password. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CWE-641 Improper Restriction of Names for Files and Other Resources. The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.
CWE-642 External Control of Critical State Data. The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection'). The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax. The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
CWE-645 Overly Restrictive Account Lockout Mechanism. The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
CWE-646 Reliance on File Name or Extension of Externally-Supplied File. The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.
CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions. The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
CWE-648 Incorrect Use of Privileged APIs. The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
CWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking. The product uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the product does not use integrity checks to detect if those inputs have been modified.
CWE-650 Trusting HTTP Permission Methods on the Server Side. The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.
CWE-651 Exposure of WSDL File Containing Sensitive Information. The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains information on the publicly accessible services and how callers of these services should interact with them (e.g. what parameters they expect and what types they return).
CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection'). The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
CWE-653 Improper Isolation or Compartmentalization. The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
CWE-654 Reliance on a Single Factor in a Security Decision. A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.
CWE-655 Insufficient Psychological Acceptability. The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.
CWE-656 Reliance on Security Through Obscurity. The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
CWE-657 Violation of Secure Design Principles. The product violates well-established principles for secure design.
CWE-662 Improper Synchronization. The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
CWE-663 Use of a Non-reentrant Function in a Concurrent Context. The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.
CWE-664 Improper Control of a Resource Through its Lifetime. The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
CWE-665 Improper Initialization. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
CWE-666 Operation on Resource in Wrong Phase of Lifetime. The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.
CWE-667 Improper Locking. The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
CWE-668 Exposure of Resource to Wrong Sphere. The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CWE-669 Incorrect Resource Transfer Between Spheres. The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
CWE-670 Always-Incorrect Control Flow Implementation. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
CWE-671 Lack of Administrator Control over Security. The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
CWE-672 Operation on a Resource after Expiration or Release. The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
CWE-673 External Influence of Sphere Definition. The product does not prevent the definition of control spheres from external actors.
CWE-674 Uncontrolled Recursion. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
CWE-675 Multiple Operations on Resource in Single-Operation Context. The product performs the same operation on a resource two or more times, when the operation should only be applied once.
CWE-676 Use of Potentially Dangerous Function. The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
CWE-680 Integer Overflow to Buffer Overflow. The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
CWE-681 Incorrect Conversion between Numeric Types. When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
CWE-682 Incorrect Calculation. The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
CWE-683 Function Call With Incorrect Order of Arguments. The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
CWE-684 Incorrect Provision of Specified Functionality. The code does not function according to its published specifications, potentially leading to incorrect usage.
CWE-685 Function Call With Incorrect Number of Arguments. The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.
CWE-686 Function Call With Incorrect Argument Type. The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.
CWE-687 Function Call With Incorrectly Specified Argument Value. The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.
CWE-688 Function Call With Incorrect Variable or Reference as Argument. The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.
CWE-689 Permission Race Condition During Resource Copy. The product, while copying or cloning a resource, does not set the resource's permissions or access control until the copy is complete, leaving the resource exposed to other spheres while the copy is taking place.
CWE-690 Unchecked Return Value to NULL Pointer Dereference. The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.
CWE-691 Insufficient Control Flow Management. The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
CWE-692 Incomplete Denylist to Cross-Site Scripting. The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
CWE-693 Protection Mechanism Failure. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-694 Use of Multiple Resources with Duplicate Identifier. The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
CWE-695 Use of Low-Level Functionality. The product uses low-level functionality that is explicitly prohibited by the framework or specification under which the product is supposed to operate.
CWE-696 Incorrect Behavior Order. The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
CWE-697 Incorrect Comparison. The product compares two entities in a security-relevant context, but the comparison is incorrect.
CWE-698 Execution After Redirect (EAR). The web application sends a redirect to another location, but instead of exiting, it executes additional code.
CWE-703 Improper Check or Handling of Exceptional Conditions. The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
CWE-704 Incorrect Type Conversion or Cast. The product does not correctly convert an object, resource, or structure from one type to a different type.
CWE-705 Incorrect Control Flow Scoping. The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.
CWE-706 Use of Incorrectly-Resolved Name or Reference. The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CWE-707 Improper Neutralization. The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CWE-708 Incorrect Ownership Assignment. The product assigns an owner to a resource, but the owner is outside of the intended control sphere.
CWE-710 Improper Adherence to Coding Standards. The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
CWE-732 Incorrect Permission Assignment for Critical Resource. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-733 Compiler Optimization Removal or Modification of Security-critical Code. The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.
CWE-749 Exposed Dangerous Method or Function. The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
CWE-754 Improper Check for Unusual or Exceptional Conditions. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CWE-755 Improper Handling of Exceptional Conditions. The product does not handle or incorrectly handles an exceptional condition.
CWE-756 Missing Custom Error Page. The product does not return custom error pages to the user, possibly exposing sensitive information.
CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'). A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.
CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior. The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.
CWE-759 Use of a One-Way Hash without a Salt. The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
CWE-760 Use of a One-Way Hash with a Predictable Salt. The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.
CWE-761 Free of Pointer not at Start of Buffer. The product calls free() on a pointer to a memory resource that was allocated on the heap, but the pointer is not at the start of the buffer.
CWE-762 Mismatched Memory Management Routines. The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.
CWE-763 Release of Invalid Pointer or Reference. The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
CWE-764 Multiple Locks of a Critical Resource. The product locks a critical resource more times than intended, leading to an unexpected state in the system.
CWE-765 Multiple Unlocks of a Critical Resource. The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.
CWE-766 Critical Data Element Declared Public. The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.
CWE-767 Access to Critical Private Variable via Public Method. The product defines a public method that reads or modifies a private variable.
CWE-768 Incorrect Short Circuit Evaluation. The product contains a conditional statement with multiple logical expressions in which one of the non-leading expressions may produce side effects. This may lead to an unexpected state in the program after the execution of the conditional, because short-circuiting logic may prevent the side effects from occurring.
CWE-770 Allocation of Resources Without Limits or Throttling. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-771 Missing Reference to Active Allocated Resource. The product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed.
CWE-772 Missing Release of Resource after Effective Lifetime. The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CWE-773 Missing Reference to Active File Descriptor or Handle. The product does not properly maintain references to a file descriptor or handle, which prevents that file descriptor/handle from being reclaimed.
CWE-774 Allocation of File Descriptors or Handles Without Limits or Throttling. The product allocates file descriptors or handles on behalf of an actor without imposing any restrictions on how many descriptors can be allocated, in violation of the intended security policy for that actor.
CWE-775 Missing Release of File Descriptor or Handle after Effective Lifetime. The product does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the file descriptor/handle is no longer needed.
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'). The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
CWE-777 Regular Expression without Anchors. The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.
CWE-778 Insufficient Logging. When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.
CWE-779 Logging of Excessive Data. The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.
CWE-780 Use of RSA Algorithm without OAEP. The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.
CWE-781 Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code. The product defines an IOCTL that uses METHOD_NEITHER for I/O, but it does not validate or incorrectly validates the addresses that are provided.
CWE-782 Exposed IOCTL with Insufficient Access Control. The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.
CWE-783 Operator Precedence Logic Error. The product uses an expression in which operator precedence causes incorrect logic to be used.
CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision. The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
CWE-785 Use of Path Manipulation Function without Maximum-sized Buffer. The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.
CWE-786 Access of Memory Location Before Start of Buffer. The product reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
CWE-787 Out-of-bounds Write. The product writes data past the end, or before the beginning, of the intended buffer.
CWE-788 Access of Memory Location After End of Buffer. The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
CWE-789 Memory Allocation with Excessive Size Value. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.