auren-research/cyber-sec huggingface dataset:
A product does not check to see if a lock is present before performing sensitive operations on a resource.

Primary

Architecture and Design

Implementation

Integrity
Availability
Modify Application Data
DoS: Instability
DoS: Crash, Exit, or Restart

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Architecture and Design
Implementation
Implement a reliable lock mechanism.

CVE-2004-1056
Product does not properly check if a lock is present, allowing other attackers to access functionality.
https://www.cve.org/CVERecord?id=CVE-2004-1056

Missing Lock Check

SFP19
Missing Lock

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Detection_Factors, Weakness_Ordinalities
The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.

Primary

Architecture and Design
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Implementation

Access Control
Gain Privileges or Assume Identity
Bypass Protection Mechanism

Architecture and Design
Do not expose administrative functionnality on the user UI.

Architecture and Design
Protect the administrative/restricted functionality with a strong authentication mechanism.

Unprotected Primary Channel

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2010-12-13
updated Related_Attack_Patterns

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2013-07-17
updated Applicable_Platforms, Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities
The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Primary

Resultant

Implementation

Access Control
Bypass Protection Mechanism

CVE-2000-1114
Source code disclosure using trailing dot
https://www.cve.org/CVERecord?id=CVE-2000-1114

CVE-2002-1986
Source code disclosure using trailing dot
https://www.cve.org/CVERecord?id=CVE-2002-1986

CVE-2004-2213
Source code disclosure using trailing dot
https://www.cve.org/CVERecord?id=CVE-2004-2213

CVE-2005-3293
Source code disclosure using trailing dot
https://www.cve.org/CVERecord?id=CVE-2005-3293

CVE-2004-0061
Bypass directory access restrictions using trailing dot in URL
https://www.cve.org/CVERecord?id=CVE-2004-0061

CVE-2000-1133
Bypass directory access restrictions using trailing dot in URL
https://www.cve.org/CVERecord?id=CVE-2000-1133

CVE-2001-1386
Bypass check for ".lnk" extension using ".lnk."
https://www.cve.org/CVERecord?id=CVE-2001-1386

File Processing

File or Directory

Trailing Dot - 'filedir.'

SFP16
Path Traversal

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Affected_Resources, Functional_Areas

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Path Issue - Trailing Dot - 'filedir.'
The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors.
This creates a race condition that allows an attacker to access the channel before the authorized user does.

Primary

Architecture and Design

Access Control
Gain Privileges or Assume Identity
Bypass Protection Mechanism

CVE-1999-0351
FTP "Pizza Thief" vulnerability. Attacker can connect to a port that was intended for use by another client.
https://www.cve.org/CVERecord?id=CVE-1999-0351

CVE-2003-0230
Product creates Windows named pipe during authentication that another attacker can hijack by connecting to it.
https://www.cve.org/CVERecord?id=CVE-2003-0230

Program Invocation

System Process

Alternate Channel Race Condition

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Observed_Example, Other_Notes, Taxonomy_Mappings, Type

CWE Content Team
MITRE
2008-10-14
updated Description

CWE Content Team
MITRE
2009-01-12
updated References

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Other_Notes

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Functional_Areas

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Alternate Channel Race Condition
The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.

Primary

Architecture and Design

Access Control
Gain Privileges or Assume Identity
Bypass Protection Mechanism

Architecture and Design
Always verify and authenticate the source of the message.

CVE-2002-0971
Bypass GUI and access restricted dialog box.
https://www.cve.org/CVERecord?id=CVE-2002-0971

CVE-2002-1230
Gain privileges via Windows message.
https://www.cve.org/CVERecord?id=CVE-2002-1230

CVE-2003-0350
A control allows a change to a pointer for a callback function using Windows message.
https://www.cve.org/CVERecord?id=CVE-2003-0350

CVE-2003-0908
Product launches Help functionality while running with raised privileges, allowing command execution using Windows message to access "open file" dialog.
https://www.cve.org/CVERecord?id=CVE-2003-0908

CVE-2004-0213
Attacker uses Shatter attack to bypass GUI-enforced protection for CVE-2003-0908.
https://www.cve.org/CVERecord?id=CVE-2004-0213

CVE-2004-0207
User can call certain API functions to modify certain properties of privileged programs.
https://www.cve.org/CVERecord?id=CVE-2004-0207

System Process

Unprotected Windows Messaging Channel ('Shatter')

SFP30
Missing endpoint authentication

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Overlaps privilege errors and UI errors.

Possibly under-reported, probably under-studied. It is suspected that a number of publicized vulnerabilities that involve local privilege escalation on Windows systems may be related to Shatter attacks, but they are not labeled as such.
Alternate channel attacks likely exist in other operating systems and messaging models, e.g. in privileged X Windows applications, but examples are not readily available.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2008-10-14
updated Other_Notes, Relationship_Notes, Research_Gaps

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
This entry has been deprecated because it was a duplicate of CWE-441. All content has been transferred to CWE-441.

Prohibited
This CWE has been deprecated.
See description and name for possible suggestions of other CWEs to consider.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2008-11-05
deprecated this entry as a duplicate of 441

CWE Content Team
MITRE
2008-11-24
updated Applicable_Platforms, Description, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type

CWE Content Team
MITRE
2009-10-29
updated Relationships

CWE Content Team
MITRE
2021-07-20
updated Name

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Proxied Trusted Channel
DEPRECATED (Duplicate): Proxied Trusted Channel
The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Primary

Architecture and Design

Access Control
Bypass Protection Mechanism
Gain Privileges or Assume Identity

Architecture and Design
Deploy different layers of protection to implement security in depth.

CVE-2022-29238
Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.
https://www.cve.org/CVERecord?id=CVE-2022-29238

Alternate Path Errors

SFP35
Insecure resource access

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-10-29
updated Other_Notes

CWE Content Team
MITRE
2010-12-13
updated Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2019-06-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Relationships, Weakness_Ordinalities

Alternate Path Errors
Failure to Protect Alternate Path
The product accepts path input in the form of multiple trailing dot ('filedir....') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Resultant

Implementation

Confidentiality
Integrity
Read Files or Directories
Modify Files or Directories

CVE-2004-0281
Multiple trailing dot allows directory listing
https://www.cve.org/CVERecord?id=CVE-2004-0281

File Processing

File or Directory

Multiple Trailing Dot - 'filedir....'

SFP16
Path Traversal

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Observed_Examples

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Affected_Resources, Functional_Areas

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Path Issue - Multiple Trailing Dot - 'filedir....'
The wrong "handler" is assigned to process an object.
An example of deploying the wrong handler would be calling a servlet to reveal source code of a .JSP file, or automatically "determining" type of the object even if it is contradictory to an explicitly specified type.

Resultant
This weakness is usually resultant from other weaknesses.

Implementation

Integrity
Other
Varies by Context
Unexpected State

Architecture and Design
Perform a type check before interpreting an object.

Architecture and Design
Reject any inconsistent types, such as a file with a .GIF extension that appears to consist of PHP code.

CVE-2001-0004
Source code disclosure via manipulated file extension that causes parsing by wrong DLL.
https://www.cve.org/CVERecord?id=CVE-2001-0004

CVE-2002-0025
Web browser does not properly handle the Content-Type header field, causing a different application to process the document.
https://www.cve.org/CVERecord?id=CVE-2002-0025

CVE-2000-1052
Source code disclosure by directly invoking a servlet.
https://www.cve.org/CVERecord?id=CVE-2000-1052

CVE-2002-1742
Arbitrary Perl functions can be loaded by calling a non-existent function that activates a handler.
https://www.cve.org/CVERecord?id=CVE-2002-1742

Improper Handler Deployment

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2008-10-14
updated Description

CWE Content Team
MITRE
2009-10-29
updated Other_Notes, Weakness_Ordinalities

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2019-06-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms

Improper Handler Deployment
A handler is not available or implemented.
When an exception is thrown and not caught, the process has given up an opportunity to decide if a given failure or event is worth a change in execution.

Primary

Implementation

Other
Varies by Context

Implementation
Handle all possible situations (e.g. error condition).

Implementation
If an operation can throw an Exception, implement a handler for that specific exception.

If a Servlet does not catch all exceptions, it may reveal debugging information that will help an adversary form a plan of attack. In the following method a DNS lookup failure will cause the Servlet to throw an exception.

protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException {String ip = req.getRemoteAddr();InetAddress addr = InetAddress.getByName(ip);...out.println("hello " + addr.getHostName());}

When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker.

CVE-2022-25302
SDK for OPC Unified Architecture (OPC UA) is missing a handler for when a cast fails, allowing for a crash
https://www.cve.org/CVERecord?id=CVE-2022-25302

Missing Handler

SFP4
Unchecked Status Condition

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Demonstrative_Examples

CWE Content Team
MITRE
2010-12-13
updated Description, Other_Notes

CWE Content Team
MITRE
2011-03-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Relationships

CWE Content Team
MITRE
2013-02-21
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities