auren-research/cyber-sec huggingface dataset:
The product operates in an environment in which its existence or specific identity should not be known, but it behaves differently than other products with equivalent functionality, in a way that is observable to an attacker.

For many kinds of products, multiple products may be available that perform the same functionality, such as a web server, network interface, or intrusion detection system. Attackers often perform "fingerprinting," which uses discrepancies in order to identify which specific product is in use. Once the specific product has been identified, the attacks can be made more customized and efficient. Often, an organization might intentionally allow the specific product to be identifiable. However, in some environments, the ability to identify a distinct product is unacceptable, and it is expected that every product would behave in exactly the same way. In these more restricted environments, a behavioral difference might pose an unacceptable risk if it makes it easier to identify the product's vendor, model, configuration, version, etc.

Primary

Resultant

Architecture and Design

Implementation

Confidentiality
Access Control
Read Application Data
Bypass Protection Mechanism

CVE-2002-0208
Product modifies TCP/IP stack and ICMP error messages in unusual ways that show the product is in use.
https://www.cve.org/CVERecord?id=CVE-2002-0208

CVE-2004-2252
Behavioral infoleak by responding to SYN-FIN packets.
https://www.cve.org/CVERecord?id=CVE-2004-2252

CVE-2000-1142
Honeypot generates an error with a "pwd" command in a particular directory, allowing attacker to know they are in a honeypot system.
https://www.cve.org/CVERecord?id=CVE-2000-1142

External behavioral inconsistency infoleak

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-12-28
updated Description, Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Description, Name, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

External Behavioral Inconsistency Information Leak
Information Exposure Through an External Behavioral Inconsistency
This entry has been deprecated, as it was not effective as a weakness and was structured more like a category. In addition, the name is inappropriate, since the "container" term is widely understood by developers in different ways than originally intended by PLOVER, the original source for this entry.

Prohibited
This CWE has been deprecated.
See description and name for possible suggestions of other CWEs to consider.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Maintenance_Notes, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Relationships

CWE Content Team
MITRE
2010-02-16
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-02-18
updated Related_Attack_Patterns

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Relationships

CWE Content Team
MITRE
2018-03-27
updated Relationships

CWE Content Team
MITRE
2019-06-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2020-02-24
updated Applicable_Platforms, Common_Consequences, Description, Maintenance_Notes, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Containment Errors (Container Errors)
This entry has been deprecated because it incorporated and confused multiple weaknesses. The issues formerly covered in this entry can be found at CWE-766 and CWE-767.

Prohibited
This CWE has been deprecated.
See description and name for possible suggestions of other CWEs to consider.

CLASP
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-20
deprecated this entry in favor of new entries which focus on the multiple weaknesses formerly described here, CWE-766 and CWE-767

CWE Content Team
MITRE
2009-05-27
updated Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Likelihood_of_Exploit, Name, Other_Notes, Potential_Mitigations, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type

CWE Content Team
MITRE
2009-10-29
updated Relationships

CWE Content Team
MITRE
2021-03-15
updated Description

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Failure to Protect Stored Data from Modification
This weakness has been deprecated because it was a duplicate of CWE-493. All content has been transferred to CWE-493.

Prohibited
This CWE has been deprecated.
See description and name for possible suggestions of other CWEs to consider.

CWE Community
2006-07-19
Draft 3
2006-07-19
Submitted by members of the CWE community to extend early CWE versions

CWE Content Team
MITRE
2008-09-08
updated Alternate_Terms, Applicable_Platforms, Common_Consequences, Description, Likelihood_of_Exploit, Name, Relationships, Type

CWE Content Team
MITRE
2009-10-29
updated Relationships

CWE Content Team
MITRE
2021-07-20
updated Name

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Failure to Provide Confidentiality for Stored Data
DEPRECATED (Duplicate): Failure to provide confidentiality for stored data
The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.

Besides public-facing web pages and code, products may store sensitive data, code that is not directly invoked, or other files under the web document root of the web server. If the server is not configured or otherwise used to prevent direct access to those files, then attackers may obtain this sensitive data.

Primary

Operation
COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Implementation
COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Confidentiality
Read Application Data

Implementation
System Configuration
Avoid storing information under the web root directory.

System Configuration
Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the web directory.

CVE-2005-1835
Data file under web root.
https://www.cve.org/CVERecord?id=CVE-2005-1835

CVE-2005-2217
Data file under web root.
https://www.cve.org/CVERecord?id=CVE-2005-2217

CVE-2002-1449
Username/password in data file under web root.
https://www.cve.org/CVERecord?id=CVE-2002-1449

CVE-2002-0943
Database file under web root.
https://www.cve.org/CVERecord?id=CVE-2002-0943

CVE-2005-1645
database file under web root.
https://www.cve.org/CVERecord?id=CVE-2005-1645

Sensitive Data Under Web Root

A10
Insecure Configuration Management
CWE More Specific

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

Veracode
2008-08-15
Suggested OWASP Top Ten 2004 mapping

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-12-28
updated Relationships

CWE Content Team
MITRE
2010-06-21
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Description, Name, Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Relationships, Weakness_Ordinalities

Sensitive Data Under Web Root
The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.

Primary

Various Unix FTP servers require a password file that is under the FTP root, due to use of chroot.

Operation

Architecture and Design
COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Confidentiality
Read Application Data

Implementation
System Configuration
Avoid storing information under the FTP root directory.

System Configuration
Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the FTP directory.

Sensitive Data Under FTP Root

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

CWE Content Team
MITRE
2008-09-08
updated Background_Details, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2015-12-07
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2018-03-27
updated Relationships

CWE Content Team
MITRE
2019-06-20
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Description, Name, Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Sensitive Data Under FTP Root
The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

Primary

Resultant
Information loss can be resultant, e.g., a
buffer overflow might trigger a crash before the
product can log the event.

Architecture and Design

Implementation

Operation

Non-Repudiation
Hide Activities

This code logs suspicious multiple login attempts.

function login($userName,$password){
if(authenticate($userName,$password)){return True;}else{incrementLoginAttempts($userName);if(recentLoginAttempts($userName) > 5){writeLog("Failed login attempt by User: " . $userName . " at " + date('r') );}}
}

This code only logs failed login attempts when a certain limit is reached. If an attacker knows this limit, they can stop their attack from being discovered by avoiding the limit.

CVE-2004-2227
Web browser's filename selection dialog only shows the beginning portion of long filenames, which can trick users into launching executables with dangerous extensions.
https://www.cve.org/CVERecord?id=CVE-2004-2227

CVE-2003-0412
application server does not log complete URI of a long request (truncation).
https://www.cve.org/CVERecord?id=CVE-2003-0412

CVE-1999-1029
Login attempts are not recorded if the user disconnects before the maximum number of tries.
https://www.cve.org/CVERecord?id=CVE-1999-1029

CVE-2002-0725
Attacker performs malicious actions on a hard link to a file, obscuring the real target file.
https://www.cve.org/CVERecord?id=CVE-2002-0725

CVE-1999-1055
Product does not warn user when document contains certain dangerous functions or macros.
https://www.cve.org/CVERecord?id=CVE-1999-1055

Information loss or omission

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Description, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Demonstrative_Examples, Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Description, Relationships, Weakness_Ordinalities
The product truncates the display, recording, or processing of security-relevant information in a way that can obscure the source or nature of an attack.

Primary

Resultant

Implementation

Operation

Non-Repudiation
Hide Activities
The source of an attack will be difficult or impossible to determine. This can allow attacks to the system to continue without notice.

CVE-2005-0585
Web browser truncates long sub-domains or paths, facilitating phishing.
https://www.cve.org/CVERecord?id=CVE-2005-0585

CVE-2004-2032
Bypass URL filter via a long URL with a large number of trailing hex-encoded space characters.
https://www.cve.org/CVERecord?id=CVE-2004-2032

CVE-2003-0412
application server does not log complete URI of a long request (truncation).
https://www.cve.org/CVERecord?id=CVE-2003-0412

Truncation of Security-relevant Information

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Common_Consequences, Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities
The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.

Primary

Resultant

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Operation

Non-Repudiation
Access Control
Hide Activities
Gain Privileges or Assume Identity

This code prints the contents of a file if a user has permission.

function readFile($filename){
$user = getCurrentUser();$realFile = $filename;

//resolve file if its a symbolic link
if(is_link($filename)){$realFile = readlink($filename);}
if(fileowner($realFile) == $user){echo file_get_contents($realFile);return;}else{echo 'Access denied';writeLog($user . ' attempted to access the file '. $filename . ' on '. date('r'));}
}

While the code logs a bad access attempt, it logs the user supplied name for the file, not the canonicalized file name. An attacker can obscure their target by giving the script the name of a link to the file they are attempting to access. Also note this code contains a race condition between the is_link() and readlink() functions (CWE-363).

CVE-2002-0725
Attacker performs malicious actions on a hard link to a file, obscuring the real target file.
https://www.cve.org/CVERecord?id=CVE-2002-0725

Obscured Security-relevant Information by Alternate Name

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-03-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Demonstrative_Examples, Modes_of_Introduction, References, Relationships

CWE Content Team
MITRE
2018-03-27
updated References

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
This weakness can be found at CWE-199.

Prohibited
This CWE has been deprecated.
See description and name for possible suggestions of other CWEs to consider.

CWE Community
2006-07-19
Draft 3
2006-07-19
Submitted by members of the CWE community to extend early CWE versions

CWE Content Team
MITRE
2008-09-08
updated Relationships

CWE Content Team
MITRE
2009-10-29
updated Relationships

CWE Content Team
MITRE
2021-07-20
updated Name

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

DEPRECATED (Duplicate): General Information Management Problems
The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.

Primary

Resultant

Implementation

Integrity
Unexpected State

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Community
2006-07-19
Draft 3
2006-07-19
Submitted by members of the CWE community to extend early CWE versions

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships

CWE Content Team
MITRE
2009-03-10
updated Description

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Description, Type

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities

Value Problems
The product does not handle or incorrectly handles when more values are provided than expected.

Primary

Resultant

Implementation
This typically occurs in situations when only one value is expected.

Integrity
Unexpected State

Extra Value Error

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This can overlap buffer overflows.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Modes_of_Introduction, Relationships, Relationship_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-03-10
updated Description, Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Description, Type

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Time_of_Introduction

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Extra Value Error
Failure to Handle Extra Value