alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
CWE-184 Incomplete List of Disallowed Inputs. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
CWE-185 Incorrect Regular Expression. The product specifies a regular expression in a way that causes data to be improperly matched or compared.
CWE-186 Overly Restrictive Regular Expression. A regular expression is overly restrictive, which prevents dangerous values from being detected.
CWE-187 Partial String Comparison. The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.
CWE-188 Reliance on Data/Memory Layout. The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.
CWE-190 Integer Overflow or Wraparound. The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-191 Integer Underflow (Wrap or Wraparound). The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-192 Integer Coercion Error. Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
CWE-193 Off-by-one Error. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CWE-194 Unexpected Sign Extension. The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.
CWE-195 Signed to Unsigned Conversion Error. The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
CWE-196 Unsigned to Signed Conversion Error. The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.
CWE-197 Numeric Truncation Error. Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
CWE-198 Use of Incorrect Byte Ordering. The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used.
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-201 Insertion of Sensitive Information Into Sent Data. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
CWE-202 Exposure of Sensitive Information Through Data Queries. When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
CWE-203 Observable Discrepancy. The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
CWE-204 Observable Response Discrepancy. The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
CWE-205 Observable Behavioral Discrepancy. The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.
CWE-206 Observable Internal Behavioral Discrepancy. The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.
CWE-207 Observable Behavioral Discrepancy With Equivalent Products. The product operates in an environment in which its existence or specific identity should not be known, but it behaves differently than other products with equivalent functionality, in a way that is observable to an attacker.
CWE-208 Observable Timing Discrepancy. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CWE-209 Generation of Error Message Containing Sensitive Information. The product generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-210 Self-generated Error Message Containing Sensitive Information. The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
CWE-211 Externally-Generated Error Message Containing Sensitive Information. The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.
CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer. The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
CWE-213 Exposure of Sensitive Information Due to Incompatible Policies. The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
CWE-214 Invocation of Process Using Visible Sensitive Information. A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
CWE-215 Insertion of Sensitive Information Into Debugging Code. The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
CWE-219 Storage of File with Sensitive Data Under Web Root. The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.
CWE-220 Storage of File With Sensitive Data Under FTP Root. The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.
CWE-221 Information Loss or Omission. The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
CWE-222 Truncation of Security-relevant Information. The product truncates the display, recording, or processing of security-relevant information in a way that can obscure the source or nature of an attack.
CWE-223 Omission of Security-relevant Information. The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
CWE-224 Obscured Security-relevant Information by Alternate Name. The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.
CWE-226 Sensitive Information in Resource Not Removed Before Reuse. The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or zeroize the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
CWE-228 Improper Handling of Syntactically Invalid Structure. The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
CWE-229 Improper Handling of Values. The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.
CWE-230 Improper Handling of Missing Values. The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.
CWE-231 Improper Handling of Extra Values. The product does not handle or incorrectly handles when more values are provided than expected.
CWE-232 Improper Handling of Undefined Values. The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.
CWE-233 Improper Handling of Parameters. The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.
CWE-234 Failure to Handle Missing Parameter. If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.
CWE-235 Improper Handling of Extra Parameters. The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.
CWE-236 Improper Handling of Undefined Parameters. The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product.
CWE-237 Improper Handling of Structural Elements. The product does not handle or incorrectly handles inputs that are related to complex structures.
CWE-238 Improper Handling of Incomplete Structural Elements. The product does not handle or incorrectly handles when a particular structural element is not completely specified.
CWE-239 Failure to Handle Incomplete Element. The product does not properly handle when a particular element is not completely specified.
CWE-240 Improper Handling of Inconsistent Structural Elements. The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
CWE-241 Improper Handling of Unexpected Data Type. The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
CWE-242 Use of Inherently Dangerous Function. The product calls a function that can never be guaranteed to work safely.
CWE-243 Creation of chroot Jail Without Changing Working Directory. The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection'). Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.
CWE-245 J2EE Bad Practices: Direct Management of Connections. The J2EE application directly manages connections, instead of using the container's connection management facilities.
CWE-246 J2EE Bad Practices: Direct Use of Sockets. The J2EE application directly uses sockets instead of using framework method calls.
CWE-248 Uncaught Exception. An exception is thrown from a function, but it is not caught.
CWE-250 Execution with Unnecessary Privileges. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
CWE-252 Unchecked Return Value. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-253 Incorrect Check of Function Return Value. The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.
CWE-256 Plaintext Storage of a Password. The product stores a password in plaintext within resources such as memory or files.
CWE-257 Storing Passwords in a Recoverable Format. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
CWE-258 Empty Password in Configuration File. Using an empty string as a password is insecure.
CWE-259 Use of Hard-coded Password. The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
CWE-260 Password in Configuration File. The product stores a password in a configuration file that might be accessible to actors who do not know the password.
CWE-261 Weak Encoding for Password. Obscuring a password with a trivial encoding does not protect the password.
CWE-262 Not Using Password Aging. The product does not have a mechanism in place for managing password aging.
CWE-263 Password Aging with Long Expiration. The product supports password aging, but the expiration period is too long.
CWE-266 Incorrect Privilege Assignment. A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-267 Privilege Defined With Unsafe Actions. A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
CWE-268 Privilege Chaining. Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
CWE-269 Improper Privilege Management. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-270 Privilege Context Switching Error. The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
CWE-271 Privilege Dropping / Lowering Errors. The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
CWE-272 Least Privilege Violation. The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
CWE-273 Improper Check for Dropped Privileges. The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
CWE-274 Improper Handling of Insufficient Privileges. The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
CWE-276 Incorrect Default Permissions. During installation, installed file permissions are set to allow anyone to modify those files.
CWE-277 Insecure Inherited Permissions. A product defines a set of insecure permissions that are inherited by objects that are created by the program.
CWE-278 Insecure Preserved Inherited Permissions. A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.
CWE-279 Incorrect Execution-Assigned Permissions. While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
CWE-280 Improper Handling of Insufficient Permissions or Privileges. The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
CWE-281 Improper Preservation of Permissions. The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
CWE-282 Improper Ownership Management. The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
CWE-283 Unverified Ownership. The product does not properly verify that a critical resource is owned by the proper entity.
CWE-284 Improper Access Control. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-285 Improper Authorization. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-286 Incorrect User Management. The product does not properly manage a user within its environment.
CWE-287 Improper Authentication. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-288 Authentication Bypass Using an Alternate Path or Channel. The product requires authentication, but the product has an alternate path or channel that does not require authentication.
CWE-289 Authentication Bypass by Alternate Name. The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
CWE-290 Authentication Bypass by Spoofing. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-291 Reliance on IP Address for Authentication. The product uses an IP address for authentication.
CWE-293 Using Referer Field for Authentication. The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.
CWE-294 Authentication Bypass by Capture-replay. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
CWE-295 Improper Certificate Validation. The product does not validate, or incorrectly validates, a certificate.
CWE-296 Improper Following of a Certificate's Chain of Trust. The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate.
CWE-297 Improper Validation of Certificate with Host Mismatch. The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
CWE-298 Improper Validation of Certificate Expiration. A certificate expiration is not validated or is incorrectly validated.
CWE-299 Improper Check for Certificate Revocation. The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
CWE-300 Channel Accessible by Non-Endpoint. The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
CWE-301 Reflection Attack in an Authentication Protocol. Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user.
CWE-302 Authentication Bypass by Assumed-Immutable Data. The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
CWE-303 Incorrect Implementation of Authentication Algorithm. The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
CWE-304 Missing Critical Step in Authentication. The product implements an authentication technique, but it skips a step that weakens the technique.
CWE-305 Authentication Bypass by Primary Weakness. The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
CWE-306 Missing Authentication for Critical Function. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-307 Improper Restriction of Excessive Authentication Attempts. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
CWE-308 Use of Single-factor Authentication. The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.
CWE-309 Use of Password System for Primary Authentication. The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.
CWE-311 Missing Encryption of Sensitive Data. The product does not encrypt sensitive or critical information before storage or transmission.
CWE-312 Cleartext Storage of Sensitive Information. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-313 Cleartext Storage in a File or on Disk. The product stores sensitive information in cleartext in a file, or on disk.
CWE-314 Cleartext Storage in the Registry. The product stores sensitive information in cleartext in the registry.
CWE-315 Cleartext Storage of Sensitive Information in a Cookie. The product stores sensitive information in cleartext in a cookie.
CWE-316 Cleartext Storage of Sensitive Information in Memory. The product stores sensitive information in cleartext in memory.
CWE-317 Cleartext Storage of Sensitive Information in GUI. The product stores sensitive information in cleartext within the GUI.
CWE-318 Cleartext Storage of Sensitive Information in Executable. The product stores sensitive information in cleartext in an executable.
CWE-319 Cleartext Transmission of Sensitive Information. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-321 Use of Hard-coded Cryptographic Key. The product uses a hard-coded, unchangeable cryptographic key.
CWE-322 Key Exchange without Entity Authentication. The product performs a key exchange with an actor without verifying the identity of that actor.
CWE-323 Reusing a Nonce, Key Pair in Encryption. Nonces should be used for the present occasion and only once.
CWE-324 Use of a Key Past its Expiration Date. The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
CWE-325 Missing Cryptographic Step. The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.