auren-research/cyber-sec huggingface dataset:
The source code contains whitespace that is inconsistent across
the code or does not follow expected standards for the
product.

Indirect

Implementation

Other
Increase Analytical Complexity
A human auditor might indirectly trust that
whitespace (especially indentation) reflects the actual
control flow of the code, which could make it more
difficult to find vulnerabilities.

Other
Reduce Maintainability
This issue makes it more difficult to understand
and maintain the product, which indirectly affects
security by making it more difficult or time-consuming
to find and/or fix vulnerabilities.

CVE-2014-1266
Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.
https://www.cve.org/CVERecord?id=CVE-2014-1266

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Observed_Examples, Time_of_Introduction
The source code contains elements such as source files
that do not consistently provide a prologue or header that has been
standardized for the project.
Standard prologues or headers may contain information such as module name, version number, author, date, purpose, function, assumptions, limitations, accuracy considerations, etc.

Indirect

Implementation

Other
Reduce Maintainability
This issue makes it more difficult to maintain the product due to insufficient analyzability, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Other
Increase Analytical Complexity
The lack of a prologue can make it more difficult to accurately and quickly understand the associated code.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The source code contains comments that do not accurately
describe or explain aspects of the portion of the code with which the comment is
associated.

Indirect

Implementation

Other
Reduce Maintainability
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Other
Increase Analytical Complexity
When a comment does not accurately reflect the associated code elements, this can introduce confusion to a reviewer (due to inconsistencies) or make it more difficult and less efficient to validate that the code is implementing the intended behavior correctly.

Implementation
Verify that each comment accurately reflects what is intended to happen during execution of the code.

In the following Java example the code performs a calculation to determine how much medicine to administer. A comment is provided to give insight into what the calculation shoud be doing. Unfortunately the comment does not match the actual code and thus leaves the reader to wonder which is correct.

public class Main {

public static void main(String[] args) {

int pt_weight = 83;
int mg_per_kg = 3;
int daily_dose = 0;

// Add the patient weight and Mg/Kg to calculate the correct daily dose
daily_dose = pt_weight * mg_per_kg;
return dosage;

}

}

In the correction below, the code functionality has been verified, and the comment has been corrected to reflect the proper calculation.

public class Main {

public static void main(String[] args) {

int pt_weight = 83;
int mg_per_kg = 3;
int daily_dose = 0;

// Multiply the patient weight and Mg/Kg to calculate the correct daily dose
daily_dose = pt_weight * mg_per_kg;
return dosage;

}

}

Note that in real-world code, these values should be validated to disallow negative numbers, prevent integer overflow, etc.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2022-10-13
updated Applicable_Platforms, Demonstrative_Examples, Potential_Mitigations

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Common_Consequences, Description, Name, Time_of_Introduction

Drew Buttner
MITRE
2022-08-15
Suggested new demonstrative examples, mitigations, and applicable platforms.

Inaccurate Comments
The code contains a function or method whose signature and/or associated
inline documentation does not sufficiently describe the callable's inputs, outputs,
side effects, assumptions, or return codes.

Indirect

Implementation

Other
Reduce Maintainability
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The documentation does not sufficiently describe the techniques
that are used for error handling, exception processing, or similar
mechanisms.
Documentation may need to cover error handling techniques at multiple layers, such as module, executable, compilable code unit, or callable.

Indirect

Documentation

Other
Reduce Maintainability

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Time_of_Introduction
The code uses too many unconditional branches (such as
"goto").

Indirect

Implementation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The code is too complex, as calculated using a well-defined,
quantitative measure.

Indirect

Implementation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Other
Reduce Performance
This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Time_of_Introduction
The code contains McCabe cyclomatic complexity that exceeds a
desirable maximum.

Indirect

Implementation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

ASCMM-MNT-11

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Time_of_Introduction
The code is structured in a way that a Halstead complexity
measure exceeds a desirable maximum.
A variety of Halstead complexity measures exist, such as program vocabulary size or volume.

Indirect

Implementation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The product uses too much self-modifying code.

Indirect

Implementation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to understand or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The code contains a callable or other code grouping in which
the nesting / branching is too deep.

Indirect

Implementation

Other
Reduce Maintainability
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The product has an attack surface whose quantitative
measurement exceeds a desirable maximum.
Originating from software security, an "attack surface" measure typically reflects the number of input points and output points that can be utilized by an untrusted party, i.e. a potential attacker. A larger attack surface provides more places to attack, and more opportunities for developers to introduce weaknesses. In some cases, this measure may reflect other aspects of quality besides security; e.g., a product with many inputs and outputs may require a large number of tests in order to improve code coverage.

Indirect

Implementation

Architecture and Design

Other
Varies by Context

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Relationships, Time_of_Introduction
The source code declares a variable in one scope, but the
variable is only used within a narrower scope.

Indirect

Implementation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Time_of_Introduction
The code is compiled without sufficient warnings enabled, which
may prevent the detection of subtle bugs or quality
issues.

Indirect

Build and Compilation

Other
Reduce Maintainability
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Manual Analysis
Inspect scripts and tools that invoke the
compiler. Ensure that the appropriate command line
switches and/or configuration are specified to report
warnings and errors.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors
The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.

Primary

Resultant

Architecture and Design

Implementation

Integrity
Unexpected State

Fuzzing
Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.
High

CVE-2005-2225
Product sees dangerous file extension in free text of a group discussion, disconnects all users.
https://www.cve.org/CVERecord?id=CVE-2005-2225

CVE-2001-0003
Product does not correctly import and process security settings from another product.
https://www.cve.org/CVERecord?id=CVE-2001-0003

Misinterpretation Error

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This concept needs further study. It is likely a factor in several weaknesses, possibly resultant as well. Overlaps Multiple Interpretation Errors (MIE).

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-10-29
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities

Misinterpretation Error