alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
CWE-1278 Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques. Information stored in hardware may be recovered by an attacker with the capability to capture and analyze images of the integrated circuit using techniques such as scanning electron microscopy.
CWE-1279 Cryptographic Operations are run Before Supporting Units are Ready. Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
CWE-1280 Access Control Check Implemented After Asset is Accessed. A product's hardware-based access control check occurs after the asset has been accessed.
CWE-1281 Sequence of Processor Instructions Leads to Unexpected Behavior. Specific combinations of processor instructions lead to undesirable behavior such as locking the processor until a hard reset performed.
CWE-1282 Assumed-Immutable Data is Stored in Writable Memory. Immutable data, such as a first-stage bootloader, device identifiers, and write-once configuration settings are stored in writable memory that can be re-programmed or updated in the field.
CWE-1283 Mutable Attestation or Measurement Reporting Data. The register contents used for attestation or measurement reporting data to verify boot flow are modifiable by an adversary.
CWE-1284 Improper Validation of Specified Quantity in Input. The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input. The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
CWE-1286 Improper Validation of Syntactic Correctness of Input. The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
CWE-1287 Improper Validation of Specified Type of Input. The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
CWE-1288 Improper Validation of Consistency within Input. The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
CWE-1289 Improper Validation of Unsafe Equivalence in Input. The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
CWE-1290 Incorrect Decoding of Security Identifiers. The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers. If the decoding is implemented incorrectly, then untrusted agents can now gain unauthorized access to the asset.
CWE-1291 Public Key Re-Use for Signing both Debug and Production Code. The same public key is used for signing both debug and production code.
CWE-1292 Incorrect Conversion of Security Identifiers. The product implements a conversion mechanism to map certain bus-transaction signals to security identifiers. However, if the conversion is incorrectly implemented, untrusted agents can gain unauthorized access to the asset.
CWE-1293 Missing Source Correlation of Multiple Independent Data. The product relies on one source of data, preventing the ability to detect if an adversary has compromised a data source.
CWE-1294 Insecure Security Identifier Mechanism. The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented.
CWE-1295 Debug Messages Revealing Unnecessary Information. The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.
CWE-1296 Incorrect Chaining or Granularity of Debug Components. The product's debug components contain incorrect chaining or granularity of debug components.
CWE-1297 Unprotected Confidential Information on Device is Accessible by OSAT Vendors. The product does not adequately protect confidential information on the device from being accessed by Outsourced Semiconductor Assembly and Test (OSAT) vendors.
CWE-1298 Hardware Logic Contains Race Conditions. A race condition in the hardware logic results in undermining security guarantees of the system.
CWE-1299 Missing Protection Mechanism for Alternate Hardware Interface. The lack of protections on alternate paths to access control-protected assets (such as unprotected shadow registers and other external facing unguarded interfaces) allows an attacker to bypass existing protections to the asset that are only performed against the primary path.
CWE-1300 Improper Protection of Physical Side Channels. The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physically observable phenomena such as variations in power consumption, electromagnetic emissions (EME), or acoustic emissions.
CWE-1301 Insufficient or Incomplete Data Removal within Hardware Component. The product's data removal process does not completely delete all data and potentially sensitive information within hardware components.
CWE-1302 Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC). The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. A transaction is sent without a security identifier.
CWE-1303 Non-Transparent Sharing of Microarchitectural Resources. Hardware structures shared across execution contexts (e.g., caches and branch predictors) can violate the expected architecture isolation between contexts.
CWE-1304 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation. The product performs a power save/restore operation, but it does not ensure that the integrity of the configuration state is maintained and/or verified between the beginning and ending of the operation.
CWE-1310 Missing Ability to Patch ROM Code. Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state.
CWE-1311 Improper Translation of Security Attributes by Fabric Bridge. The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.
CWE-1312 Missing Protection for Mirrored Regions in On-Chip Fabric Firewall. The firewall in an on-chip fabric protects the main addressed region, but it does not protect any mirrored memory or memory-mapped-IO (MMIO) regions.
CWE-1313 Hardware Allows Activation of Test or Debug Logic at Runtime. During runtime, the hardware allows for test or debug logic (feature) to be activated, which allows for changing the state of the hardware. This feature can alter the intended behavior of the system and allow for alteration and leakage of sensitive data by an adversary.
CWE-1314 Missing Write Protection for Parametric Data Values. The device does not write-protect the parametric data values for sensors that scale the sensor value, allowing untrusted software to manipulate the apparent result and potentially damage hardware or cause operational failure.
CWE-1315 Improper Setting of Bus Controlling Capability in Fabric End-point. The bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric.
CWE-1316 Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges. The address map of the on-chip fabric has protected and unprotected regions overlapping, allowing an attacker to bypass access control to the overlapping portion of the protected region.
CWE-1317 Improper Access Control in Fabric Bridge. The product uses a fabric bridge for transactions between two Intellectual Property (IP) blocks, but the bridge does not properly perform the expected privilege, identity, or other access control checks between those IP blocks.
CWE-1318 Missing Support for Security Features in On-chip Fabrics or Buses. On-chip fabrics or buses either do not support or are not configured to support privilege separation or other security features, such as access control.
CWE-1319 Improper Protection against Electromagnetic Fault Injection (EM-FI). The device is susceptible to electromagnetic fault injection attacks, causing device internal information to be compromised or security mechanisms to be bypassed.
CWE-1320 Improper Protection for Outbound Error Messages and Alert Signals. Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CWE-1322 Use of Blocking Code in Single-threaded, Non-blocking Context. The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked.
CWE-1323 Improper Management of Sensitive Trace Data. Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected locations or transported to untrusted agents.
CWE-1325 Improperly Controlled Sequential Memory Allocation. The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
CWE-1326 Missing Immutable Root of Trust in Hardware. A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.
CWE-1327 Binding to an Unrestricted IP Address. The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
CWE-1328 Security Version Number Mutable to Older Versions. Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.
CWE-1329 Reliance on Component That is Not Updateable. The product contains a component that cannot be updated or patched in order to remove vulnerabilities or significant bugs.
CWE-1330 Remanent Data Readable after Memory Erase. Confidential information stored in memory circuits is readable or recoverable after being cleared or erased.
CWE-1331 Improper Isolation of Shared Resources in Network On Chip (NoC). The Network On Chip (NoC) does not isolate or incorrectly isolates its on-chip-fabric and internal resources such that they are shared between trusted and untrusted agents, creating timing channels.
CWE-1332 Improper Handling of Faults that Lead to Instruction Skips. The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occur.
CWE-1333 Inefficient Regular Expression Complexity. The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
CWE-1334 Unauthorized Error Injection Can Degrade Hardware Redundancy. An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode.
CWE-1335 Incorrect Bitwise Shift of Integer. An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.
CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
CWE-1338 Improper Protections Against Hardware Overheating. A hardware device is missing or has inadequate protection features to prevent overheating.
CWE-1339 Insufficient Precision or Accuracy of a Real Number. The product processes a real number with an implementation in which the number's representation does not preserve required accuracy and precision in its fractional part, causing an incorrect result.
CWE-1341 Multiple Releases of Same Resource or Handle. The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
CWE-1342 Information Exposure through Microarchitectural State after Transient Execution. The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution.
CWE-1351 Improper Handling of Hardware Behavior in Exceptionally Cold Environments. A hardware device, or the firmware running on it, is missing or has incorrect protection features to maintain goals of security primitives when the device is cooled below standard operating temperatures.
CWE-1357 Reliance on Insufficiently Trustworthy Component. The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.
CWE-1384 Improper Handling of Physical or Environmental Conditions. The product does not properly handle unexpected physical or environmental conditions that occur naturally or are artificially induced.
CWE-1385 Missing Origin Validation in WebSockets. The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
CWE-1386 Insecure Operation on Windows Junction / Mount Point. The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere.
CWE-1389 Incorrect Parsing of Numbers with Different Radices. The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix).
CWE-1390 Weak Authentication. The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
CWE-1391 Use of Weak Credentials. The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
CWE-1392 Use of Default Credentials. The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
CWE-1393 Use of Default Password. The product uses default passwords for potentially critical functionality.
CWE-1394 Use of Default Cryptographic Key. The product uses a default cryptographic key for potentially critical functionality.
CWE-1395 Dependency on Vulnerable Third-Party Component. The product has a dependency on a third-party component that contains one or more known vulnerabilities.
CWE-1419 Incorrect Initialization of Resource. The product attempts to initialize a resource but does not correctly do so, which might leave the resource in an unexpected, incorrect, or insecure state when it is accessed.
CWE-1420 Exposure of Sensitive Information during Transient Execution. A processor event or prediction may allow incorrect operations (or correct operations with incorrect data) to execute transiently, potentially exposing data over a covert channel.
CWE-1421 Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution. A processor event may allow transient operations to access architecturally restricted data (for example, in another address space) in a shared microarchitectural structure (for example, a CPU cache), potentially exposing the data over a covert channel.
CWE-1422 Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution. A processor event or prediction may allow incorrect or stale data to be forwarded to transient operations, potentially exposing data over a covert channel.
CWE-1423 Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution. Shared microarchitectural predictor state may allow code to influence transient execution across a hardware boundary, potentially exposing data that is accessible beyond the boundary over a covert channel.
CWE-1426 Improper Validation of Generative AI Output. The product invokes a generative AI/ML component whose behaviors and outputs cannot be directly controlled, but the product does not validate or insufficiently validates the outputs to ensure that they align with the intended security, content, or privacy policy.
CWE-1427 Improper Neutralization of Input Used for LLM Prompting. The product uses externally-provided data to build prompts provided to large language models (LLMs), but the way these prompts are constructed causes the LLM to fail to distinguish between user-supplied inputs and developer provided system directives.
CWE-1428 Reliance on HTTP instead of HTTPS. The product provides or relies on use of HTTP communications when HTTPS is available.
CWE-1429 Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface. The product has a hardware interface that silently discards operations in situations for which feedback would be security-relevant, such as the timely detection of failures or attacks.
CWE-1431 Driving Intermediate Cryptographic State/Results to Hardware Module Outputs. The product uses a hardware module implementing a cryptographic algorithm that writes sensitive information about the intermediate state or results of its cryptographic operations via one of its output wires (typically the output port containing the final result).
CWE-1434 Insecure Setting of Generative AI/ML Model Inference Parameters. The product has a component that relies on a generative AI/ML model configured with inference parameters that produce an unacceptably high rate of erroneous or unexpected outputs.
Threat intelligence note: adversaries leveraging T1055.011 (Extra Window Memory Injection) during stealth, privilege escalation. Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process. Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data).(Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft
Threat intelligence note: adversaries leveraging T1053.005 (Scheduled Task) during execution, persistence, privilege escalation. Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.(Citation: Stack Overflow) In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.(Citation: Red Canary - Atomic
Threat intelligence note: adversaries leveraging T1205.002 (Socket Filters) during stealth, persistence, command and control. Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket. The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell. To establish a connection, an adversary sends a crafted packet to the targeted host that matches the installed filter criteria.(Citation: haking9 libpcap network sniffing) Adversaries have used these socket filters to trigger the installation of implants, conduct ping backs, and to invoke
Threat intelligence note: adversaries leveraging T1560.001 (Archive via Utility) during collection. Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use
Threat intelligence note: adversaries leveraging T1021.005 (VNC) during lateral movement. Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol) VNC differs from [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) as VNC is screen-sharing software rather than resource-sharing software. By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.(Citation: MacOS VNC software for Remote Desktop)(Citation: VNC Authentication) Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files