auren-research/cyber-sec huggingface dataset:
The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.

Primary

Resultant

Implementation

Integrity
Unexpected State

In this example, an address parameter is read and trimmed of whitespace.

String address = request.getParameter("address");address = address.trim();String updateString = "UPDATE shippingInfo SET address='?' WHERE email='cwe@example.com'";emailAddress = con.prepareStatement(updateString);emailAddress.setString(1, address);

If the value of the address parameter is null (undefined), the servlet will throw a NullPointerException when the trim() is attempted.

CVE-2000-1003
Client crash when server returns unknown driver type.
https://www.cve.org/CVERecord?id=CVE-2000-1003

Undefined Value Error

ERR08-J
Do not catch NullPointerException or any of its ancestors

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Sean Eidemiller
Cigital
2008-07-01
added/updated demonstrative examples

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-03-10
updated Description, Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Type

CWE Content Team
MITRE
2014-07-30
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2017-05-03
updated Demonstrative_Examples

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2019-01-03
updated Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Undefined Value Error
Failure to Handle Undefined Value
The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.

Primary

Resultant

Implementation
This typically occurs in situations when only one element is expected to be specified.

Integrity
Unexpected State

CVE-2003-1014
MIE. multiple gateway/security products allow restriction bypass using multiple MIME fields with the same name, which are interpreted differently by clients.
https://www.cve.org/CVERecord?id=CVE-2003-1014

Extra Parameter Error

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This type of problem has a big role in multiple interpretation vulnerabilities and various HTTP attacks.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Modes_of_Introduction, Relationships, Relationship_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-03-10
updated Description, Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2013-07-17
updated Description, Type

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Time_of_Introduction

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities

Extra Parameter Error
Failure to Handle Extra Parameter
The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product.

Primary

Resultant

Implementation

Integrity
Unexpected State

CVE-2002-1488
Crash in IRC client via PART message from a channel the user is not in.
https://www.cve.org/CVERecord?id=CVE-2002-1488

CVE-2001-0650
Router crash or bad route modification using BGP updates with invalid transitive attribute.
https://www.cve.org/CVERecord?id=CVE-2001-0650

Undefined Parameter Error

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Observed_Example, Taxonomy_Mappings

CWE Content Team
MITRE
2009-03-10
updated Description, Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Type

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Undefined Parameter Error
Failure to Handle Undefined Parameter
The product does not handle or incorrectly handles inputs that are related to complex structures.

Primary

Resultant

Implementation

Integrity
Unexpected State

In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.

int processMessageFromSocket(int socket) {
int success;
char buffer[BUFFER_SIZE];char message[MESSAGE_SIZE];

// get message from socket and store into buffer

//Ignoring possibliity that buffer > BUFFER_SIZE
if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {

// place contents of the buffer into message structure
ExMessage *msg = recastBuffer(buffer);

// copy message body into string for processing
int index;for (index = 0; index < msg->msgLength; index++) {message[index] = msg->msgBody[index];}message[index] = '\0';

// process message
success = processMessage(message);
}return success;
}

However, the message length variable (msgLength) from the structure is used as the condition for ending the for loop without validating that msgLength accurately reflects the actual length of the message body (CWE-606). If msgLength indicates a length that is longer than the size of a message body (CWE-130), then this can result in a buffer over-read by reading past the end of the buffer (CWE-126).

Element Problems

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-03-10
updated Description, Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Type

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Demonstrative_Examples, Time_of_Introduction, Weakness_Ordinalities

Element Problems
The product does not handle or incorrectly handles when a particular structural element is not completely specified.

Resultant

Implementation

Integrity
Unexpected State

Missing Element Error

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Can be primary to other problems.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Relationship_Notes, Taxonomy_Mappings, Weakness_Ordinalities

CWE Content Team
MITRE
2009-03-10
updated Description, Name

CWE Content Team
MITRE
2009-10-29
updated Description

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Type

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Causal_Nature

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Missing Element Error
Failure to Handle Missing Element
The product does not properly handle when a particular element is not completely specified.

Primary

Resultant

Implementation

Integrity
Other
Varies by Context
Unexpected State

CVE-2002-1532
HTTP GET without \r\n\r\n CRLF sequences causes product to wait indefinitely and prevents other users from accessing it.
https://www.cve.org/CVERecord?id=CVE-2002-1532

CVE-2003-0195
Partial request is not timed out.
https://www.cve.org/CVERecord?id=CVE-2003-0195

CVE-2005-2526
MFV. CPU exhaustion in printer via partial printing request then early termination of connection.
https://www.cve.org/CVERecord?id=CVE-2005-2526

CVE-2002-1906
CPU consumption by sending incomplete HTTP requests and leaving the connections open.
https://www.cve.org/CVERecord?id=CVE-2002-1906

Incomplete Element

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Observed_Example, Taxonomy_Mappings

CWE Content Team
MITRE
2009-10-29
updated Description

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Type

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Incomplete Element
This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.

Prohibited
This CWE has been deprecated.
See description for suggestions for other CWE IDs to use.

7 Pernicious Kingdoms
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-07-27
updated Demonstrative_Examples

CWE Content Team
MITRE
2010-02-16
updated Relationships

CWE Content Team
MITRE
2010-04-05
updated Related_Attack_Patterns

CWE Content Team
MITRE
2010-09-27
updated Potential_Mitigations

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Demonstrative_Examples, References, Relationships

CWE Content Team
MITRE
2013-06-23
Critical
CWE-247 and CWE-292 deprecated and merged into CWE-350 to address duplicates.

CWE Content Team
MITRE
2013-07-17
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Time_of_Introduction, Type

CWE Content Team
MITRE
2014-07-30
updated Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated References

CWE Content Team
MITRE
2021-03-15
updated Taxonomy_Mappings

CWE Content Team
MITRE
2021-07-20
updated Name, References

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Often Misused: Authentication
Reliance on DNS Lookups in a Security Decision
DEPRECATED (Duplicate): Reliance on DNS Lookups in a Security Decision
This entry has been deprecated because of name
confusion and an accidental combination of multiple
weaknesses. Most of its content has been transferred to
CWE-785.

This entry was deprecated for several reasons. The primary
reason is over-loading of the "path manipulation" term and the
description. The original description for this entry was the
same as that for the "Often Misused: File System" item in the
original Seven Pernicious Kingdoms paper. However, Seven
Pernicious Kingdoms also has a "Path Manipulation" phrase that
is for external control of pathnames (CWE-73), which is a
factor in symbolic link following and path traversal, neither
of which is explicitly mentioned in 7PK. Fortify uses the
phrase "Often Misused: Path Manipulation" for a broader range
of problems, generally for issues related to buffer
management. Given the multiple conflicting uses of this term,
there is a chance that CWE users may have incorrectly mapped
to this entry.

The second reason for deprecation is an implied combination of
multiple weaknesses within buffer-handling functions. The
focus of this entry was generally on the path-conversion
functions and their association with buffer
overflows. However, some of Fortify's Vulncat entries have the
term "path manipulation" but describe a non-overflow weakness
in which the buffer is not guaranteed to contain the entire
pathname, i.e., there is information truncation (see CWE-222
for a similar concept). A new entry for this non-overflow
weakness may be created in a future version of CWE.

Prohibited
This CWE has been deprecated.
See description for suggestions for other CWE IDs to use.

7 Pernicious Kingdoms
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

KDM Analytics
2008-08-01
added/updated white box definitions

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Demonstrative_Examples

KDM Analytics
2009-07-17
Critical
Described inconsistencies in this entry, which the CWE Content Team had already slated for deprecation.

CWE Content Team
MITRE
2009-07-27
updated Affected_Resources, Applicable_Platforms, Demonstrative_Examples, Description, Maintenance_Notes, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type, White_Box_Definitions

CWE Content Team
MITRE
2009-10-29
updated Relationships

CWE Content Team
MITRE
2021-03-15
updated Description, Maintenance_Notes

CWE Content Team
MITRE
2022-10-13
updated Description

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Often Misused: Path Manipulation
A product defines a set of insecure permissions that are inherited by objects that are created by the program.

Primary

Architecture and Design

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Operation

Confidentiality
Integrity
Read Application Data
Modify Application Data

Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Architecture and Design
Separation of Privilege

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

CVE-2005-1841
User's umask is used when creating temp files.
https://www.cve.org/CVERecord?id=CVE-2005-1841

CVE-2002-1786
Insecure umask for core dumps [is the umask preserved or assigned?].
https://www.cve.org/CVERecord?id=CVE-2002-1786

Insecure inherited permissions

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-12-10
updated Potential_Mitigations

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.

Primary

Architecture and Design

Operation

Confidentiality
Integrity
Read Application Data
Modify Application Data

Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Architecture and Design
Separation of Privilege

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

CVE-2005-1724
Does not obey specified permissions when exporting.
https://www.cve.org/CVERecord?id=CVE-2005-1724

Insecure preserved inherited permissions

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-12-10
updated Potential_Mitigations

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities