auren-research/cyber-sec huggingface dataset:
When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the bean's data. These methods could be leveraged to read sensitive information, or to change data in ways that violate the application's expectations, potentially leading to other vulnerabilities.

Primary

Architecture and Design

Implementation

Confidentiality
Integrity
Read Application Data
Modify Application Data

Implementation
Declare Java beans "local" when possible. When a bean must be remotely accessible, make sure that sensitive information is not exposed, and ensure that the application logic performs appropriate validation of any data that might be modified by an attacker.

The following example demonstrates the weakness.

<ejb-jar><enterprise-beans><entity><ejb-name>EmployeeRecord</ejb-name><home>com.wombat.empl.EmployeeRecordHome</home><remote>com.wombat.empl.EmployeeRecord</remote>...</entity>...</enterprise-beans></ejb-jar>

J2EE Misconfiguration: Unsafe Bean Declaration

SFP23
Exposed Data

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Entity beans that expose a remote interface become part of an application's attack surface. For performance reasons, an application should rarely use remote entity beans, so there is a good chance that a remote entity bean declaration is an error.

7 Pernicious Kingdoms
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-07-27
updated Demonstrative_Examples

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Demonstrative_Examples

CWE Content Team
MITRE
2020-02-24
updated References, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities
The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.

An automated attacker could bypass the intended protection of the CAPTCHA challenge and perform actions at a higher frequency than humanly possible, such as launching spam attacks.
There can be several different causes of a guessable CAPTCHA:

An audio or visual image that does not have sufficient distortion from the unobfuscated source image.
A question is generated with a format that can be automatically recognized, such as a math question.
A question for which the number of possible answers is limited, such as birth years or favorite sports teams.
A general-knowledge or trivia question for which the answer can be accessed using a data base, such as country capitals or popular entertainers.
Other data associated with the CAPTCHA may provide hints about its contents, such as an image whose filename contains the word that is used in the CAPTCHA.

Primary

Architecture and Design

Implementation

Access Control
Other
Bypass Protection Mechanism
Other
When authorization, authentication, or another protection mechanism relies on CAPTCHA entities to ensure that only human actors can access certain functionality, then an automated attacker such as a bot may access the restricted functionality by guessing the CAPTCHA.

CVE-2022-4036
Chain: appointment booking app uses a weak hash (CWE-328) for generating a CAPTCHA, making it guessable (CWE-804)
https://www.cve.org/CVERecord?id=CVE-2022-4036

21
Insufficient Anti-Automation

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2010-01-15
1.8
2010-02-16
New entry to handle anti-automation as identified in WASC.

CWE Content Team
MITRE
2010-06-21
updated Common_Consequences

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Likelihood_of_Exploit

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2022-10-13
updated Description, Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples
The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
If access to a shared resource is not synchronized, then the resource may not be in a state that is expected by the product. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.

Primary

Implementation

Integrity
Confidentiality
Other
Modify Application Data
Read Application Data
Alter Execution Logic

The following code intends to fork a process, then have both the parent and child processes print a single line.

static void print (char * string) {
char * word;int counter;for (word = string; counter = *word++; ) {
putc(counter, stdout);fflush(stdout);
/* Make timing window a little larger... */

sleep(1);
}
}
int main(void) {
pid_t pid;
pid = fork();if (pid == -1) {exit(-2);}else if (pid == 0) {print("child\n");}else {print("PARENT\n");}exit(0);
}

One might expect the code to print out something like:

PARENT
child

However, because the parent and child are executing concurrently, and stdout is flushed each time a character is printed, the output might be mixed together, such as:

PcAhRiElNdT
[blank line]
[blank line]

LCK05-J
Synchronize access to static fields that can be modified by untrusted code

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Deeper research is necessary for synchronization and related mechanisms, including locks, mutexes, semaphores, and other mechanisms. Multiple entries are dependent on this research, which includes relationships to concurrency, race conditions, reentrant functions, etc. CWE-662 and its children - including CWE-667, CWE-820, CWE-821, and others - may need to be modified significantly, along with their relationships.

CWE Content Team
MITRE
2010-08-06
1.10
2010-09-27

CWE Content Team
MITRE
2010-12-13
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2013-07-17
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Demonstrative_Examples

CWE Content Team
MITRE
2019-01-03
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2019-09-23
updated Maintenance_Notes

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Time_of_Introduction, Weakness_Ordinalities
The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.
If access to a shared resource is not correctly synchronized, then the resource may not be in a state that is expected by the product. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.

Primary

Implementation

Integrity
Confidentiality
Other
Modify Application Data
Read Application Data
Alter Execution Logic

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Deeper research is necessary for synchronization and related mechanisms, including locks, mutexes, semaphores, and other mechanisms. Multiple entries are dependent on this research, which includes relationships to concurrency, race conditions, reentrant functions, etc. CWE-662 and its children - including CWE-667, CWE-820, CWE-821, and others - may need to be modified significantly, along with their relationships.

CWE Content Team
MITRE
2010-08-06
1.10
2010-09-27

CWE Content Team
MITRE
2010-12-13
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2019-01-03
updated Relationships

CWE Content Team
MITRE
2019-09-23
updated Maintenance_Notes

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Detection_Factors, Time_of_Introduction, Weakness_Ordinalities
The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.

As DTDs are processed, they might try to read or include files on the machine performing the parsing. If an attacker is able to control the DTD, then the attacker might be able to specify sensitive resources or requests or provide malicious content.
For example, the SOAP specification prohibits SOAP messages from containing DTDs.

Primary

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Confidentiality
Read Files or Directories
If the attacker is able to include a crafted DTD and a default entity resolver is enabled, the attacker may be able to access arbitrary files on the system.

Availability
DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
The DTD may cause the parser to consume excessive CPU cycles or memory using techniques such as nested or recursive entity references (CWE-776).

Integrity
Confidentiality
Availability
Access Control
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity
The DTD may include arbitrary HTTP requests that the server may execute. This could lead to other attacks leveraging the server's trust relationship with other entities.

CVE-2010-2076
Product does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service.
https://www.cve.org/CVERecord?id=CVE-2010-2076

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2010-10-25
1.11
2010-12-13

CWE Content Team
MITRE
2011-03-29
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2013-02-21
updated Applicable_Platforms

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2019-06-20
updated Type

CWE Content Team
MITRE
2020-02-24
updated Applicable_Platforms, Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
The product attempts to unlock a resource that is not locked.
Depending on the locking functionality, an unlock of a non-locked resource might cause memory corruption or other modification to the resource (or its associated metadata that is used for tracking locks).

Resultant

Implementation

Integrity
Confidentiality
Availability
Other
DoS: Crash, Exit, or Restart
Execute Unauthorized Code or Commands
Modify Memory
Other
Depending on the locking being used, an unlock operation might not have any adverse effects. When effects exist, the most common consequence will be a corruption of the state of the product, possibly leading to a crash or exit; depending on the implementation of the unlocking, memory corruption or code execution could occur.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

CVE-2010-4210
function in OS kernel unlocks a mutex that was not previously locked, causing a panic or overwrite of arbitrary memory.
https://www.cve.org/CVERecord?id=CVE-2010-4210

CVE-2008-4302
Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.
https://www.cve.org/CVERecord?id=CVE-2008-4302

CVE-2009-1243
OS kernel performs an unlock in some incorrect circumstances, leading to panic.
https://www.cve.org/CVERecord?id=CVE-2009-1243

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2010-12-12
1.11
2010-12-13

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Common_Consequences, Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Detection_Factors, Time_of_Introduction, Weakness_Ordinalities
The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.

Some authentication mechanisms rely on the client to generate the hash for a password, possibly to reduce load on the server or avoid sending the password across the network. However, when the client is used to generate the hash, an attacker can bypass the authentication by obtaining a copy of the hash, e.g. by using SQL injection to compromise a database of authentication credentials, or by exploiting an information exposure. The attacker could then use a modified client to replay the stolen hash without having knowledge of the original password.
As a result, the server-side comparison against a client-side hash does not provide any more security than the use of passwords without hashing.

Primary

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Access Control
Bypass Protection Mechanism
Gain Privileges or Assume Identity
An attacker could bypass the authentication routine without knowing the original password.

CVE-2009-1283
Product performs authentication with user-supplied password hashes that can be obtained from a separate SQL injection vulnerability (CVE-2009-1282).
https://www.cve.org/CVERecord?id=CVE-2009-1283

CVE-2005-3435
Product allows attackers to bypass authentication by obtaining the password hash for another user and specifying the hash in the pwd argument.
https://www.cve.org/CVERecord?id=CVE-2005-3435

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2011-03-22
1.12
2011-03-30

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-10-30
updated Observed_Examples

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2022-10-13
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.
In various applications, a user is only expected to perform a certain action once, such as voting, requesting a refund, or making a purchase. When this restriction is not enforced, sometimes this can have security implications. For example, in a voting application, an attacker could attempt to "stuff the ballot box" by voting multiple times. If these votes are counted separately, then the attacker could directly affect who wins the vote. This could have significant business impact depending on the purpose of the product.

Primary

Resultant

Implementation

Other
Varies by Context
An attacker might be able to gain advantage over other users by performing the action multiple times, or affect the correctness of the product.

CVE-2008-0294
Ticket-booking web application allows a user to lock a seat more than once.
https://www.cve.org/CVERecord?id=CVE-2008-0294

CVE-2005-4051
CMS allows people to rate downloads by voting more than once.
https://www.cve.org/CVERecord?id=CVE-2005-4051

CVE-2002-216
Polling software allows people to vote more than once by setting a cookie.
https://www.cve.org/CVERecord?id=CVE-2002-216

CVE-2003-1433
Chain: lack of validation of a challenge key in a game allows a player to register multiple times and lock other players out of the game.
https://www.cve.org/CVERecord?id=CVE-2003-1433

CVE-2002-1018
Library feature allows attackers to check out the same e-book multiple times, preventing other users from accessing copies of the e-book.
https://www.cve.org/CVERecord?id=CVE-2002-1018

CVE-2009-2346
Protocol implementation allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many message exchanges.
https://www.cve.org/CVERecord?id=CVE-2009-2346

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2011-03-24
1.12
2011-03-30

CWE Content Team
MITRE
2012-05-11
updated Observed_Examples

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Common_Consequences, Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Common_Consequences

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Time_of_Introduction, Weakness_Ordinalities
The product or the administrator places a user into an incorrect group.
If the incorrect group has more access or privileges than the intended group, the user might be able to bypass intended security policy to access unexpected resources or perform unexpected actions. The access-control system might not be able to detect malicious usage of this group membership.

Primary

Implementation

Operation

Access Control
Gain Privileges or Assume Identity

CVE-1999-1193
Operating system assigns user to privileged wheel group, allowing the user to gain root privileges.
https://www.cve.org/CVERecord?id=CVE-1999-1193

CVE-2010-3716
Chain: drafted web request allows the creation of users with arbitrary group membership.
https://www.cve.org/CVERecord?id=CVE-2010-3716

CVE-2008-5397
Chain: improper processing of configuration options causes users to contain unintended group memberships.
https://www.cve.org/CVERecord?id=CVE-2008-5397

CVE-2007-6644
CMS does not prevent remote administrators from promoting other users to the administrator group, in violation of the intended security model.
https://www.cve.org/CVERecord?id=CVE-2007-6644

CVE-2007-3260
Product assigns members to the root group, allowing escalation of privileges.
https://www.cve.org/CVERecord?id=CVE-2007-3260

CVE-2002-0080
Chain: daemon does not properly clear groups before dropping privileges.
https://www.cve.org/CVERecord?id=CVE-2002-0080

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2011-03-24
1.12
2011-03-30

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities