auren-research/cyber-sec huggingface dataset:
The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities.

While the interpretation of "large number of data accesses/queries" may vary for each product or developer, CISQ recommends a default maximum of 2 data accesses per function/method.

Indirect

Architecture and Design

Other
Reduce Performance
This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability.

ASCPEM-PRF-10

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Description, Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Applicable_Platforms

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Common_Consequences, Description, Time_of_Introduction
A class has an inheritance level that is too high, i.e., it
has a large number of parent classes.

While the interpretation of "large number of parent classes" may vary for each product or developer, CISQ recommends a default maximum of 7 parent classes.

Indirect

Implementation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to understand and maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

ASCMM-MNT-17

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Description, Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The product performs unconditional control transfer (such as a
"goto") in code outside of a branching structure such as a switch
block.

Indirect

Implementation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

ASCMM-MNT-1

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Time_of_Introduction
The product's architecture, source code, design, documentation,
or other artifact does not follow required conventions.

Indirect

Architecture and Design

Implementation

Documentation

Other
Reduce Maintainability
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

The usage of symbolic names instead of hard-coded constants is preferred.
The following is an example of using a hard-coded constant instead of a symbolic name.

char buffer[1024];...fgets(buffer, 1024, stdin);

If the buffer value needs to be changed, then it has to be altered in more than one place. If the developer forgets or does not find all occurrences, in this example it could lead to a buffer overflow.

enum { MAX_BUFFER_SIZE = 1024 };...char buffer[MAX_BUFFER_SIZE];...fgets(buffer, MAX_BUFFER_SIZE, stdin);

In this example the developer will only need to change one value and all references to the buffer size are updated, as a symbolic name is used instead of a hard-coded constant.

The following code fragment calls finalize() explicitly:

// time to clean up
widget.finalize();

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes, Relationships

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Time_of_Introduction
The code performs a comparison such as an
equality test between two float (floating point) values, but
it uses comparison operators that do not account for the
possibility of loss of precision.

Numeric calculation using floating point values
can generate imprecise results because of rounding errors.
As a result, two different calculations might generate
numbers that are mathematically equal, but have slightly
different bit representations that do not translate to the
same mathematically-equal values. As a result, an equality
test or other comparison might produce unexpected
results.

Indirect

Implementation

Other
Reduce Reliability
This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

ASCRM-RLB-9

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Time_of_Introduction
The source code does not follow
desired style or formatting for indentation, white
space, comments, etc.

Indirect

Implementation

Other
Increase Analytical Complexity
Variations in indentation and other white space,
comments, etc. can make it more difficult for human
analysts to understand the actual behavior that is
being implemented.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

The usage of symbolic names instead of hard-coded constants is preferred.
The following is an example of using a hard-coded constant instead of a symbolic name.

char buffer[1024];...fgets(buffer, 1024, stdin);

If the buffer value needs to be changed, then it has to be altered in more than one place. If the developer forgets or does not find all occurrences, in this example it could lead to a buffer overflow.

enum { MAX_BUFFER_SIZE = 1024 };...char buffer[MAX_BUFFER_SIZE];...fgets(buffer, MAX_BUFFER_SIZE, stdin);

In this example the developer will only need to change one value and all references to the buffer size are updated, as a symbolic name is used instead of a hard-coded constant.

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples, Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Detection_Factors, Time_of_Introduction
A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.

Indirect

Implementation

Other
Reduce Reliability
This issue can prevent the product from running reliably due to undefined or unexpected behaviors. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

ASCRM-RLB-16

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Time_of_Introduction
Every Action Form must have a corresponding validation form.
If a Struts Action Form Mapping specifies a form, it must have a validation form defined under the Struts Validator.

Primary

Implementation

Other
Other
If an action form mapping does not have a validation form defined, it may be vulnerable to a number of attacks that rely on unchecked input. Unchecked input is the root cause of some of today's worst and most common software security problems. Cross-site scripting, SQL injection, and process control vulnerabilities all stem from incomplete or absent input validation.

Confidentiality
Integrity
Availability
Other
Other
Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.

Implementation
Input Validation

Map every Action Form to a corresponding validation form.
An action or a form may perform validation in other ways, but the Struts Validator provides an excellent way to verify that all input receives at least a basic level of validation. Without this approach, it is difficult, and often impossible, to establish with a high level of confidence that all input is validated.

Struts: Unvalidated Action Form

SFP24
Tainted input to command

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

7 Pernicious Kingdoms
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities

CWE Content Team
MITRE
2008-11-24
updated Common_Consequences, Description, Other_Notes

CWE Content Team
MITRE
2009-12-28
updated Common_Consequences, Other_Notes

CWE Content Team
MITRE
2011-03-29
updated Other_Notes

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Other_Notes, Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Causal_Nature, Relationships

CWE Content Team
MITRE
2019-01-03
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated References, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes
A source code file has too many lines of
code.

While the interpretation of "too many lines of code" may vary for each product or developer, CISQ recommends a default threshold value of 1000.

Indirect

Implementation

Other
Reduce Maintainability
Increase Analytical Complexity
This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

ASCMM-MNT-8

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Description, Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Time_of_Introduction
The code contains a class instance that calls the method or function to delete or destroy itself.
For example, in C++, "delete this" will cause the object to delete itself.

Indirect

Implementation

Other
Reduce Reliability
This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.

ASCRM-RLB-7

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component.
When the product has a data access component, the design may be intended to handle all data access operations through that component. If a data access operation is performed outside of that component, then this may indicate a violation of the intended design.

Indirect

Implementation

Other
Reduce Reliability
This issue can prevent the product from running reliably. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.

ASCRM-RLB-10

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
A function or method contains too many
operations that utilize a data manager or file resource.

While the interpretation of "too many operations" may vary for each product or developer, CISQ recommends a default maximum of 7 operations for the same data manager or file.

Indirect

Implementation

Other
Reduce Maintainability
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

ASCMM-MNT-14

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Description, Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction