auren-research/cyber-sec huggingface dataset:
The product adds hooks to user-accessible API functions, but it does not properly validate the arguments. This could lead to resultant vulnerabilities.
Such hooks can be used in defensive software that runs with privileges, such as anti-virus or firewall, which hooks kernel calls. When the arguments are not validated, they could be used to bypass the protection scheme or attack the product itself.

Primary

Implementation

Integrity
Unexpected State

Architecture and Design
Ensure that all arguments are verified, as defined by the API you are protecting.

Architecture and Design
Drop privileges before invoking such functions, if possible.

CVE-2007-0708
DoS in firewall using standard Microsoft functions
https://www.cve.org/CVERecord?id=CVE-2007-0708

CVE-2006-7160
DoS in firewall using standard Microsoft functions
https://www.cve.org/CVERecord?id=CVE-2006-7160

CVE-2007-1376
function does not verify that its argument is the proper type, leading to arbitrary memory write
https://www.cve.org/CVERecord?id=CVE-2007-1376

CVE-2007-1220
invalid syscall arguments bypass code execution limits
https://www.cve.org/CVERecord?id=CVE-2007-1220

CVE-2006-4541
DoS in IDS via NULL argument
https://www.cve.org/CVERecord?id=CVE-2006-4541

SFP27
Tainted input to environment

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2007-05-07
Draft 6
2007-05-07

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Description, Relationships, Observed_Example, Other_Notes

CWE Content Team
MITRE
2009-12-28
updated Other_Notes, Weakness_Ordinalities

CWE Content Team
MITRE
2010-09-27
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Name, Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Unvalidated Function Hook Arguments
An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.
This might allow attackers to use dangerous functionality via a web page that accesses the control, which can lead to different resultant vulnerabilities, depending on the control's behavior.

Primary

Architecture and Design

Implementation

Confidentiality
Integrity
Availability
Execute Unauthorized Code or Commands

Architecture and Design
During development, do not mark it as safe for scripting.

System Configuration
After distribution, you can set the kill bit for the control so that it is not accessible from Internet Explorer.

CVE-2007-0617
control allows attackers to add malicious email addresses to bypass spam limits
https://www.cve.org/CVERecord?id=CVE-2007-0617

CVE-2007-0219
web browser uses certain COM objects as ActiveX
https://www.cve.org/CVERecord?id=CVE-2007-0219

CVE-2006-6510
kiosk allows bypass to read files
https://www.cve.org/CVERecord?id=CVE-2006-6510

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2007-05-07
Draft 6
2007-05-07

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Description, Relationships, Observed_Example, Weakness_Ordinalities

CWE Content Team
MITRE
2010-02-16
updated References

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated References

CWE Content Team
MITRE
2018-03-27
updated References

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Observed_Examples

CWE Content Team
MITRE
2022-04-28
updated Research_Gaps

CWE Content Team
MITRE
2023-01-31
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms
The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
While this weakness might be caught by the compiler in some languages, it can occur more frequently in cases in which the called function accepts variable numbers or types of arguments, such as format strings in C. It also can occur in languages or environments that do not enforce strong typing.

Primary

Implementation
This problem typically occurs when the programmer makes a typo, or copy and paste errors.

Other
Quality Degradation

Automated Analysis
Because this function call often produces
incorrect behavior, it will usually be detected during
testing or normal operation of the product.

Automated Analysis
Exercising all possible control paths will
typically expose this weakness, except in rare cases when
the incorrect function call accidentally produces the
correct results, or if the provided argument type is very
similar to the expected argument type.

Implementation
Use the function, procedure, or routine as specified.

The following PHP method authenticates a user given a username/password combination but is called with the parameters in reverse order.

function authenticate($username, $password) {

// authenticate user
...
}
authenticate($_POST['password'], $_POST['username']);

CVE-2006-7049
Application calls functions with arguments in the wrong order, allowing attacker to bypass intended access restrictions.
https://www.cve.org/CVERecord?id=CVE-2006-7049

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2008-04-11
Draft 9
2008-04-11

Sean Eidemiller
Cigital
2008-07-01
added/updated demonstrative examples

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations

CWE Content Team
MITRE
2008-09-08
updated Description, Relationships, Other_Notes, Weakness_Ordinalities

CWE Content Team
MITRE
2009-05-27
updated Demonstrative_Examples

CWE Content Team
MITRE
2009-10-29
updated Modes_of_Introduction, Other_Notes, Potential_Mitigations

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description, Potential_Mitigations

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Detection_Factors, Potential_Mitigations
The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.

Primary

Implementation
This problem typically occurs when the programmer makes a typo, or copy and paste errors.

Other
Quality Degradation

Other
While this weakness might be caught by the compiler in some languages, it can occur more frequently in cases in which the called function accepts variable numbers of arguments, such as format strings in C. It also can occur in languages or environments that do not require that functions always be called with the correct number of arguments, such as Perl.

Testing
Because this function call often produces incorrect behavior it will usually be detected during testing or normal operation of the product. During testing exercise all possible control paths will typically expose this weakness except in rare cases when the incorrect function call accidentally produces the correct results or if the provided argument type is very similar to the expected argument type.

SFP1
Glitch in computation

EXP37-C
Call functions with the correct number and type of arguments
CWE More Specific

FIO47-C
Use valid format strings
Imprecise

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2008-04-11
Draft 9
2008-04-11

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Detection_Factors, Relationships, Other_Notes, Weakness_Ordinalities

CWE Content Team
MITRE
2009-05-27
updated Description

CWE Content Team
MITRE
2009-10-29
updated Modes_of_Introduction, Other_Notes, Potential_Mitigations

CWE Content Team
MITRE
2010-02-16
updated Detection_Factors

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Taxonomy_Mappings

CWE Content Team
MITRE
2019-01-03
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description, Potential_Mitigations

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes
The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.
This weakness is most likely to occur in loosely typed languages, or in strongly typed languages in which the types of variable arguments cannot be enforced at compilation time, or where there is implicit casting.

Primary

Implementation

Other
Quality Degradation

Other
Because this function call often produces
incorrect behavior, it will usually be detected during
testing or normal operation of the product.
Opportunistic

EXP37-C
Call functions with the correct number and type of arguments
CWE More Specific

FIO47-C
Use valid format strings
Imprecise

POS34-C
Do not call putenv() with a pointer to an automatic variable as the argument

STR37-C
Arguments to character handling functions must be representable as an unsigned char

SFP1
Glitch in computation

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2008-04-11
Draft 9
2008-04-11

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations

CWE Content Team
MITRE
2008-09-08
updated Description, Relationships, Other_Notes, Weakness_Ordinalities

CWE Content Team
MITRE
2008-11-24
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Description

CWE Content Team
MITRE
2009-10-29
updated Other_Notes, Potential_Mitigations

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2011-09-13
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Taxonomy_Mappings

CWE Content Team
MITRE
2019-01-03
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description, Potential_Mitigations

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Detection_Factors, Potential_Mitigations
The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.

Primary

Implementation

Other
Quality Degradation

Manual Static Analysis
This might require an understanding of intended program behavior or design to determine whether the value is incorrect.

This Perl code intends to record whether a user authenticated successfully or not, and to exit if the user fails to authenticate. However, when it calls ReportAuth(), the third argument is specified as 0 instead of 1, so it does not exit.

sub ReportAuth {my ($username, $result, $fatal) = @_;PrintLog("auth: username=%s, result=%d", $username, $result);if (($result ne "success") && $fatal) {die "Failed!\n";}}
sub PrivilegedFunc{my $result = CheckAuth($username);ReportAuth($username, $result, 0);DoReallyImportantStuff();}

MEM04-C
Do not perform zero length allocations

SFP24
Tainted input to command

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

When primary, this weakness is most likely to occur in rarely-tested code, since the wrong value can change the semantic meaning of the program's execution and lead to obviously-incorrect behavior. It can also be resultant from issues in which the program assigns the wrong value to a variable, and that variable is later used in a function call. In that sense, this issue could be argued as having chaining relationships with many implementation errors in CWE.

CWE Content Team
MITRE
2008-04-11
Draft 9
2008-04-11

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations

CWE Content Team
MITRE
2008-09-08
updated Detection_Factors, Relationships, Other_Notes, Weakness_Ordinalities

CWE Content Team
MITRE
2008-11-24
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Description

CWE Content Team
MITRE
2009-10-29
updated Other_Notes, Relationship_Notes

CWE Content Team
MITRE
2010-02-16
updated Detection_Factors

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2011-09-13
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2021-03-15
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists.

Primary

Implementation

Confidentiality
Integrity
Availability
Execute Unauthorized Code or Commands

CVE-2007-5727
Denylist only removes <SCRIPT> tag.
https://www.cve.org/CVERecord?id=CVE-2007-5727

CVE-2006-3617
Denylist only removes <SCRIPT> tag.
https://www.cve.org/CVERecord?id=CVE-2006-3617

CVE-2006-4308
Denylist only checks "javascript:" tag
https://www.cve.org/CVERecord?id=CVE-2006-4308

Discouraged
This CWE entry is a named chain, which combines multiple weaknesses.
Mapping to each separate weakness in the chain would be more precise.

CWE Content Team
MITRE
2008-04-11
Draft 9
2008-04-11

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Relationships, Other_Notes

CWE Content Team
MITRE
2008-09-24
added Language_Class "All"

CWE Content Team
MITRE
2008-10-14
updated Applicable_Platforms

CWE Content Team
MITRE
2009-03-10
updated Related_Attack_Patterns

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Related_Attack_Patterns

CWE Content Team
MITRE
2014-06-23
updated Applicable_Platforms, Description, Other_Notes

CWE Content Team
MITRE
2017-01-19
updated Relationships

CWE Content Team
MITRE
2017-05-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2017-11-08
updated Relationships, Relevant_Properties

CWE Content Team
MITRE
2019-01-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2020-06-25
updated Description, Name, Observed_Examples, References

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes, Relationships

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Time_of_Introduction, Weakness_Ordinalities

Incomplete Blacklist to Cross-Site Scripting
This entry has been deprecated as it represents a specific observed example of a UNIX Hard Link weakness type rather than its own individual weakness type. Please refer to CWE-62.

Prohibited
This CWE has been deprecated.
See description and name for possible suggestions of other CWEs to consider.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2008-10-14
updated Maintenance_Notes

CWE Content Team
MITRE
2009-03-10
updated Related_Attack_Patterns

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-05-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Common_Consequences, Description, Maintenance_Notes, Name, Observed_Examples, Relationships, Research_Gaps, Time_of_Introduction, Type

CWE Content Team
MITRE
2021-03-15
updated Taxonomy_Mappings

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Apple '.DS_Store'
The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Primary

Indirect

Architecture and Design

Implementation

Other
Other

Automated Static Analysis
Automated tools can detect violations of many code standards.

Policy
Select and require coding
standards. Ensure that they include security
concerns.

Implementation
Closely follow coding standards, possibly
enforcing them upon checkin of the code into a source
control system or with periodic analyses.

Discouraged
This CWE entry is extremely high-level, a Pillar.
Consider children or descendants of this entry instead.

CWE Content Team
MITRE
2008-09-09
1.0
2008-09-09

CWE Content Team
MITRE
2009-03-10
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2013-02-21
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-01-19
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Name, Relationships

CWE Content Team
MITRE
2019-01-03
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Applicable_Platforms, Relationships, Type

CWE Content Team
MITRE
2022-04-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Relationships

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Detection_Factors, Potential_Mitigations, Weakness_Ordinalities

Coding Standards Violation
The product does not adequately filter user-controlled input for special elements with control implications.

Primary

Resultant

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Integrity
Confidentiality
Availability
Modify Application Data
Execute Unauthorized Code or Commands

Requirements
Programming languages and supporting technologies might be chosen which are not subject to these issues.

Implementation
Utilize an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.

Special Element Injection

Discouraged
This CWE entry might be under consideraton for deprecation, as it is not easily distinguishable from CWE-74.
N/A

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2010-12-13
updated Description

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-05-03
updated Potential_Mitigations, Related_Attack_Patterns

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Potential_Mitigations

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Special Element Injection