alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
CWE-472 External Control of Assumed-Immutable Web Parameter. The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
CWE-473 PHP External Variable Modification. A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
CWE-474 Use of Function with Inconsistent Implementations. The code uses a function that has inconsistent implementations across operating systems and versions.
CWE-475 Undefined Behavior for Input to API. The behavior of this function is undefined unless its control parameter is set to a specific value.
CWE-476 NULL Pointer Dereference. The product dereferences a pointer that it expects to be valid but is NULL.
CWE-477 Use of Obsolete Function. The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
CWE-478 Missing Default Case in Multiple Condition Expression. The code does not have a default case in an expression with multiple conditions, such as a switch statement.
CWE-479 Signal Handler Use of a Non-reentrant Function. The product defines a signal handler that calls a non-reentrant function.
CWE-480 Use of Incorrect Operator. The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.
CWE-481 Assigning instead of Comparing. The code uses an operator for assignment when the intention was to perform a comparison.
CWE-482 Comparing instead of Assigning. The code uses an operator for comparison when the intention was to perform an assignment.
CWE-483 Incorrect Block Delimitation. The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
CWE-484 Omitted Break Statement in Switch. The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.
CWE-486 Comparison of Classes by Name. The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.
CWE-487 Reliance on Package-level Scope. Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
CWE-488 Exposure of Data Element to Wrong Session. The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
CWE-489 Active Debug Code. The product is released with debugging code still enabled or active.
CWE-491 Public cloneable() Method Without Final ('Object Hijack'). A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.
CWE-492 Use of Inner Class Containing Sensitive Data. Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers.
CWE-493 Critical Public Variable Without Final Modifier. The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
CWE-494 Download of Code Without Integrity Check. The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
CWE-495 Private Data Structure Returned From A Public Method. The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
CWE-496 Public Data Assigned to Private Array-Typed Field. Assigning public data to a private array is equivalent to giving public access to the array.
CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere. The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
CWE-498 Cloneable Class Containing Sensitive Information. The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
CWE-499 Serializable Class Containing Sensitive Data. The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.
CWE-500 Public Static Field Not Marked Final. An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
CWE-501 Trust Boundary Violation. The product mixes trusted and untrusted data in the same data structure or structured message.
CWE-502 Deserialization of Untrusted Data. The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-506 Embedded Malicious Code. The product contains code that appears to be malicious in nature.
CWE-507 Trojan Horse. The product appears to contain benign or useful functionality, but it also contains code that is hidden from normal operation that violates the intended security policy of the user or the system administrator.
CWE-508 Non-Replicating Malicious Code. Non-replicating malicious code only resides on the target system or product that is attacked; it does not attempt to spread to other systems.
CWE-509 Replicating Malicious Code (Virus or Worm). Replicating malicious code, including viruses and worms, will attempt to attack other systems once it has successfully compromised the target system or the product.
CWE-510 Trapdoor. A trapdoor is a hidden piece of code that responds to a special input, allowing its user access to resources without passing through the normal security enforcement mechanism.
CWE-511 Logic/Time Bomb. The product contains code that is designed to disrupt the legitimate operation of the product (or its environment) when a certain time passes, or when a certain logical condition is met.
CWE-512 Spyware. The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.
CWE-514 Covert Channel. A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.
CWE-515 Covert Storage Channel. A covert storage channel transfers information through the setting of bits by one program and the reading of those bits by another. What distinguishes this case from that of ordinary operation is that the bits are used to convey encoded information.
CWE-520 .NET Misconfiguration: Use of Impersonation. Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.
CWE-521 Weak Password Requirements. The product does not require that users should have strong passwords.
CWE-522 Insufficiently Protected Credentials. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-523 Unprotected Transport of Credentials. Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
CWE-524 Use of Cache Containing Sensitive Information. The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
CWE-525 Use of Web Browser Cache Containing Sensitive Information. The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable. The product uses an environment variable to store unencrypted sensitive information.
CWE-527 Exposure of Version-Control Repository to an Unauthorized Control Sphere. The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere. The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
CWE-529 Exposure of Access Control List Files to an Unauthorized Control Sphere. The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere.
CWE-530 Exposure of Backup File to an Unauthorized Control Sphere. A backup file is stored in a directory or archive that is made accessible to unauthorized actors.
CWE-531 Inclusion of Sensitive Information in Test Code. Accessible test applications can pose a variety of security risks. Since developers or administrators rarely consider that someone besides themselves would even know about the existence of these applications, it is common for them to contain sensitive information or functions.
CWE-532 Insertion of Sensitive Information into Log File. The product writes sensitive information to a log file.
CWE-535 Exposure of Information Through Shell Error Message. A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.
CWE-536 Servlet Runtime Error Message Containing Sensitive Information. A servlet error message indicates that there exists an unhandled exception in the web application code and may provide useful information to an attacker.
CWE-537 Java Runtime Error Message Containing Sensitive Information. In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.
CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory. The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
CWE-539 Use of Persistent Cookies Containing Sensitive Information. The web application uses persistent cookies, but the cookies contain sensitive information.
CWE-540 Inclusion of Sensitive Information in Source Code. Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.
CWE-541 Inclusion of Sensitive Information in an Include File. If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system.
CWE-543 Use of Singleton Pattern Without Synchronization in a Multithreaded Context. The product uses the singleton pattern when creating a resource within a multithreaded environment.
CWE-544 Missing Standardized Error Handling Mechanism. The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.
CWE-546 Suspicious Comment. The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.
CWE-547 Use of Hard-coded, Security-relevant Constants. The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
CWE-548 Exposure of Information Through Directory Listing. The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.
CWE-549 Missing Password Field Masking. The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.
CWE-550 Server-generated Error Message Containing Sensitive Information. Certain conditions, such as network failure, will cause a server error message to be displayed.
CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization. If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
CWE-552 Files or Directories Accessible to External Parties. The product makes files or directories accessible to unauthorized actors, even though they should not be.
CWE-553 Command Shell in Externally Accessible Directory. A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web server.
CWE-554 ASP.NET Misconfiguration: Not Using Input Validation Framework. The ASP.NET application does not use an input validation framework.
CWE-555 J2EE Misconfiguration: Plaintext Password in Configuration File. The J2EE application stores a plaintext password in a configuration file.
CWE-556 ASP.NET Misconfiguration: Use of Identity Impersonation. Configuring an ASP.NET application to run with impersonated credentials may give the application unnecessary privileges.
CWE-558 Use of getlogin() in Multithreaded Application. The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.
CWE-560 Use of umask() with chmod-style Argument. The product calls umask() with an incorrect argument that is specified as if it is an argument to chmod().
CWE-561 Dead Code. The product contains dead code, which can never be executed.
CWE-562 Return of Stack Variable Address. A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.
CWE-563 Assignment to Variable without Use. The variable's value is assigned but never used, making it a dead store.
CWE-564 SQL Injection: Hibernate. Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.
CWE-565 Reliance on Cookies without Validation and Integrity Checking. The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key. The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
CWE-567 Unsynchronized Access to Shared Data in a Multithreaded Context. The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
CWE-568 finalize() Method Without super.finalize(). The product contains a finalize() method that does not call super.finalize().
CWE-570 Expression is Always False. The product contains an expression that will always evaluate to false.
CWE-571 Expression is Always True. The product contains an expression that will always evaluate to true.
CWE-572 Call to Thread run() instead of start(). The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.
CWE-573 Improper Following of Specification by Caller. The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.
CWE-574 EJB Bad Practices: Use of Synchronization Primitives. The product violates the Enterprise JavaBeans (EJB) specification by using thread synchronization primitives.
CWE-575 EJB Bad Practices: Use of AWT Swing. The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing.
CWE-576 EJB Bad Practices: Use of Java I/O. The product violates the Enterprise JavaBeans (EJB) specification by using the java.io package.
CWE-577 EJB Bad Practices: Use of Sockets. The product violates the Enterprise JavaBeans (EJB) specification by using sockets.
CWE-578 EJB Bad Practices: Use of Class Loader. The product violates the Enterprise JavaBeans (EJB) specification by using the class loader.
CWE-579 J2EE Bad Practices: Non-serializable Object Stored in Session. The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.
CWE-580 clone() Method Without super.clone(). The product contains a clone() method that does not call super.clone() to obtain the new object.
CWE-581 Object Model Violation: Just One of Equals and Hashcode Defined. The product does not maintain equal hashcodes for equal objects.
CWE-582 Array Declared Public, Final, and Static. The product declares an array public, final, and static, which is not sufficient to prevent the array's contents from being modified.
CWE-583 finalize() Method Declared Public. The product violates secure coding principles for mobile code by declaring a finalize() method public.
CWE-584 Return Inside Finally Block. The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.
CWE-586 Explicit Call to Finalize(). The product makes an explicit call to the finalize() method from outside the finalizer.
CWE-587 Assignment of a Fixed Address to a Pointer. The product sets a pointer to a specific address other than NULL or 0.
CWE-588 Attempt to Access Child of a Non-structure Pointer. Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption.
CWE-589 Call to Non-ubiquitous API. The product uses an API function that does not exist on all versions of the target platform. This could cause portability problems or inconsistencies that allow denial of service or other consequences.
CWE-590 Free of Memory not on the Heap. The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
CWE-591 Sensitive Data Storage in Improperly Locked Memory. The product stores sensitive data in memory that is not locked, or that has been incorrectly locked, which might cause the memory to be written to swap files on disk by the virtual memory manager. This can make the data more accessible to external actors.
CWE-593 Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created. The product modifies the SSL context after connection creation has begun.
CWE-594 J2EE Framework: Saving Unserializable Objects to Disk. When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.
CWE-595 Comparison of Object References Instead of Object Contents. The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.
CWE-597 Use of Wrong Operator in String Comparison. The product uses the wrong operator when comparing a string, such as using == when the .equals() method should be used instead.
CWE-598 Use of HTTP Request With Sensitive Query String. The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
CWE-599 Missing Validation of OpenSSL Certificate. The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
CWE-600 Uncaught Exception in Servlet. The Servlet does not catch all exceptions, which may reveal sensitive debugging information.
CWE-601 URL Redirection to Untrusted Site ('Open Redirect'). The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-602 Client-Side Enforcement of Server-Side Security. The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
CWE-603 Use of Client-Side Authentication. A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
CWE-605 Multiple Binds to the Same Port. When multiple sockets are allowed to bind to the same port, other services on that port may be stolen or spoofed.
CWE-606 Unchecked Input for Loop Condition. The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
CWE-607 Public Static Final Field References Mutable Object. A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.
CWE-608 Struts: Non-private Field in ActionForm Class. An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.
CWE-609 Double-Checked Locking. The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.
CWE-610 Externally Controlled Reference to a Resource in Another Sphere. The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
CWE-611 Improper Restriction of XML External Entity Reference. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CWE-612 Improper Authorization of Index Containing Sensitive Information. The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.
CWE-613 Insufficient Session Expiration. According to WASC, Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.
CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. The Secure attribute for sensitive cookies in HTTPS sessions is not set.
CWE-615 Inclusion of Sensitive Information in Source Code Comments. While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.
CWE-616 Incomplete Identification of Uploaded File Variables (PHP). The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.
CWE-617 Reachable Assertion. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CWE-618 Exposed Unsafe ActiveX Method. An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain).
CWE-619 Dangling Database Cursor ('Cursor Injection'). If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor dangling.
CWE-620 Unverified Password Change. When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.