auren-research/cyber-sec huggingface dataset:
The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.

Primary

Resultant

Implementation

Integrity
Other
Modify Application Data
Alter Execution Logic
The application could be placed in an insecure state that may allow an attacker to modify sensitive data or allow unintended logic to be executed.

Implementation
Follow the principle of failing securely when an error occurs. The system should enter a state where it is not vulnerable and will not display sensitive error messages to a potential attacker.

The following code intends to limit certain operations to the administrator only.

$username = GetCurrentUser();$state = GetStateData($username);if (defined($state)) {$uid = ExtractUserID($state);}

# do stuff
if ($uid == 0) {DoAdminThings();}

If the application is unable to extract the state information - say, due to a database timeout - then the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as equivalent to "0" in the conditional, allowing the original user to perform administrator actions. Even if the attacker cannot directly influence the state data, unexpected errors could cause incorrect privileges to be assigned to a user just by accident.

CVE-2005-1345
Product does not trigger a fatal error if missing or invalid ACLs are in a configuration file.
https://www.cve.org/CVERecord?id=CVE-2005-1345

Non-exit on Failed Initialization

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Under-studied. These issues are not frequently reported, and it is difficult to find published examples.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Common_Consequences, Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
This weakness has been deprecated because its name and description did not match. The description duplicated CWE-454, while the name suggested a more abstract initialization problem. Please refer to CWE-665 for the more abstract problem.

Prohibited
This CWE has been deprecated.
CWE-665 or its descendants may be appropriate.

CWE Community
2006-07-19
Draft 3
2006-07-19
Submitted by members of the CWE community to extend early CWE versions

CWE Content Team
MITRE
2008-09-08
updated Relationships

CWE Content Team
MITRE
2009-10-29
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Incorrect Initialization
The product accepts path input in the form of trailing space ('filedir ') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Resultant

Implementation

Confidentiality
Integrity
Read Files or Directories
Modify Files or Directories

CVE-2001-0693
Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2001-0693

CVE-2001-0778
Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2001-0778

CVE-2001-1248
Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2001-1248

CVE-2004-0280
Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2004-0280

CVE-2004-2213
Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2004-2213

CVE-2005-0622
Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2005-0622

CVE-2005-1656
Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2005-1656

CVE-2002-1603
Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2002-1603

CVE-2001-0054
Multi-Factor Vulnerability (MFV). directory traversal and other issues in FTP server using Web encodings such as "%20"; certain manipulations have unusual side effects.
https://www.cve.org/CVERecord?id=CVE-2001-0054

CVE-2002-1451
Trailing space ("+" in query string) leads to source code disclosure.
https://www.cve.org/CVERecord?id=CVE-2002-1451

File Processing

File or Directory

Trailing Space - 'filedir '

SFP16
Path Traversal

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2019-06-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Affected_Resources, Functional_Areas

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities

Path Issue - Trailing Space - 'filedir '
Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error.
A duplicate key entry -- if the alist is designed properly -- could be used as a constant time replace function. However, duplicate key entries could be inserted by mistake. Because of this ambiguity, duplicate key entries in an association list are not recommended and should not be allowed.

Primary

Implementation

Low

Other
Quality Degradation
Varies by Context

Architecture and Design
Use a hash table instead of an alist.

Architecture and Design
Use an alist which checks the uniqueness of hash keys with each entry before inserting the entry.

The following code adds data to a list and then attempts to sort the data.

alist = []while (foo()): #now assume there is a string data with a key basenamequeue.append(basename,data)queue.sort()

Since basename is not necessarily unique, this may not sort how one would like it to be.

Duplicate key in associative list (alist)

ENV02-C
Beware of multiple environment variables with the same effective name

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CLASP
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2008-11-24
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-10-29
updated Demonstrative_Examples, Description, Other_Notes

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2011-09-13
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated References, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction, Type

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
The product accepts path input in the form of leading space (' filedir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Resultant

Implementation

Confidentiality
Integrity
Read Files or Directories
Modify Files or Directories

File Processing

File or Directory

Leading Space - ' filedir'

SFP16
Path Traversal

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Affected_Resources, Functional_Areas

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Path Issue - Leading Space - ' filedir'
Path Equivalence: ' filename (Leading Space)
The code uses a function that has inconsistent implementations across operating systems and versions.

The use of inconsistent implementations can cause changes in behavior when the code is ported or built under a different environment than the programmer expects, which can lead to security problems in some cases.
The implementation of many functions varies by platform, and at times, even by different versions of the same platform. Implementation differences can include:

Slight differences in the way parameters are interpreted leading to inconsistent results.
Some implementations of the function carry significant security risks.
The function might not be defined on all platforms.
The function might change which return codes it can provide, or change the meaning of its return codes.

Primary

Indirect

Implementation

Other
Quality Degradation
Varies by Context

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Architecture and Design
Requirements
Do not accept inconsistent behavior from the API specifications when the deviant behavior increase the risk level.

Inconsistent Implementations

SFP3
Use of an improper API

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

7 Pernicious Kingdoms
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Other_Notes

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Applicable_Platforms, Description, Other_Notes

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Relationships

CWE Content Team
MITRE
2019-01-03
updated Relationships, Weakness_Ordinalities

CWE Content Team
MITRE
2020-02-24
updated References, Relationships

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Inconsistent Implementations
The behavior of this function is undefined unless its control parameter is set to a specific value.

Indirect

Architecture and Design

Implementation

Other
Quality Degradation
Varies by Context

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Undefined Behavior

SFP1
Glitch in computation

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

The Linux Standard Base Specification 2.0.1 for libc places constraints on the arguments to some internal functions [21]. If the constraints are not met, the behavior of the functions is not defined. It is unusual for this function to be called directly. It is almost always invoked through a macro defined in a system header file, and the macro ensures that the following constraints are met: The value 1 must be passed to the third parameter (the version number) of the following file system function: __xmknod The value 2 must be passed to the third parameter (the group argument) of the following wide character string functions: __wcstod_internal __wcstof_internal __wcstol_internal __wcstold_internal __wcstoul_internal The value 3 must be passed as the first parameter (the version number) of the following file system functions: __xstat __lxstat __fxstat __xstat64 __lxstat64 __fxstat64

7 Pernicious Kingdoms
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Relationships

CWE Content Team
MITRE
2019-01-03
updated Weakness_Ordinalities

CWE Content Team
MITRE
2020-02-24
updated References, Relationships

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Undefined Behavior
The product accepts path input in the form of internal space ('file(SPACE)name') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Primary

Resultant

Implementation

Confidentiality
Integrity
Read Files or Directories
Modify Files or Directories

CVE-2000-0293
Filenames with spaces allow arbitrary file deletion when the product does not properly quote them; some overlap with path traversal.
https://www.cve.org/CVERecord?id=CVE-2000-0293

CVE-2001-1567
"+" characters in query string converted to spaces before sensitive file/extension (internal space), leading to bypass of access restrictions to the file.
https://www.cve.org/CVERecord?id=CVE-2001-1567

File Processing

File or Directory

file(SPACE)name (internal space)

A9
Denial of Service
CWE More Specific

SFP16
Path Traversal

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This weakness is likely to overlap quoting problems, e.g. the "Program Files" unquoted search path (CWE-428). It also could be an equivalence issue if filtering removes all extraneous spaces.
Whitespace can be a factor in other weaknesses not directly related to equivalence. It can also be used to spoof icons or hide files with dangerous names (see icon manipulation and visual truncation in CWE-451).

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Applicable_Platforms, Other_Notes, Relationship_Notes

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Affected_Resources, Functional_Areas

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Path Issue - Internal Space - file(SPACE)name
Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
The purpose of package scope is to prevent accidental access by other parts of a program. This is an ease-of-software-development feature but not a security feature.

Primary

Implementation

Medium

Confidentiality
Read Application Data
Any data in a Java package can be accessed outside of the Java framework if the package is distributed.

Integrity
Modify Application Data
The data in a Java class can be modified by anyone outside of the Java framework if the package is distributed.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Architecture and Design
Implementation
Data should be private static and final whenever possible. This will assure that your code is protected by instantiating early, preventing access and tampering.

The following example demonstrates the weakness.

package math;public class Lebesgue implements Integration{
public final Static String youAreHidingThisFunction(functionToIntegrate){

return ...;
}
}

Relying on package-level scope

MET04-J
Do not increase the accessibility of overridden or hidden methods

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CLASP
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Description, Other_Notes, Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2019-01-03
updated Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated References, Type

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Common_Consequences, Detection_Factors, Weakness_Ordinalities

Relying on Package-level Scope