deardaniel/secdata-raw huggingface dataset:
CWE-413: Improper Resource Locking

Description:
The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.

Extended Description:
When a resource is not properly locked, an attacker could modify the resource while it is being operated on by the product. This might violate the product's assumption that the resource will not change, potentially leading to unexpected behaviors.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-667

Consequences:
  - Integrity: Modify Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Use a non-conflicting privilege scheme.
  - [Architecture and Design] Use synchronization when locking a resource.

Demonstrative examples:
The following function attempts to acquire a lock in order to perform operations on a shared resource.
However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior.
void f(pthread_mutex_t *mutex) { 
                         pthread_mutex_lock(mutex); 
                            
                            /* access shared resource */ 
                            
                            
                            pthread_mutex_unlock(mutex); 
                      }
int f(pthread_mutex_t *mutex) { 
                         int result; 
                            result = pthread_mutex_lock(mutex); 

This Java example shows a simple BankAccount class with deposit and withdraw methods.
However, the deposit and withdraw methods have shared access to the account balance private class variable. This can result in a race condition if multiple threads attempt to call the deposit and withdraw methods simultaneously where the account balance is modified by one thread before another thread has completed modifying the account balance. For example, if a thread attempts to withdraw funds using the withdraw method before another thread that is depositing funds using the deposit method completes the deposit then there may not be sufficient funds for the withdraw transaction.
public class BankAccount { 
                         
                            
                            // variable for

Real-world examples:
  - CVE-2022-20141: Chain: an operating system kernel has insufficent resource locking (CWE-413) leading to a use after free (CWE-416).
CWE-414: Missing Lock Check

Description:
A product does not check to see if a lock is present before performing sensitive operations on a resource.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-667

Consequences:
  - Integrity: Modify Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Implement a reliable lock mechanism.

Real-world examples:
  - CVE-2004-1056: Product does not properly check if a lock is present, allowing other attackers to access functionality.
CWE-415: Double Free

Description:
The product calls free() twice on the same memory address.

Affected languages: Memory-Unsafe, C, C++
Parent weaknesses: CWE-825, CWE-1341, CWE-672, CWE-672, CWE-672

Consequences:
  - Integrity: Modify Memory

Detection methods:
  - Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with rand
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
  - Automated Dynamic Analysis: Use tools that are integrated during
	     compilation to insert runtime error-checking mechanisms
	     related to memory safety errors, such as AddressSanitizer
	     (ASan) for C/C++ [REF-1518].

Mitigations:
  - [Architecture and Design] Choose a language that provides automatic memory management.
  - [Implementation] Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object
  - [Implementation] Use a static analysis tool to find double free instances.

Demonstrative examples:
The following code shows a simple example of a double free vulnerability.
Double free vulnerabilities have two common (and sometimes overlapping) causes:
char* ptr = (char*)malloc (SIZE); 
				   ... 
				   if (abrt) {
				    
					 free(ptr);
				    
				   } 
				   ... 
				   free(ptr);

While contrived, this code should be exploitable on Linux distributions that do not ship with heap-chunk check summing turned on.

#include <stdio.h> #include <unistd.h> #define BUFSIZE1 512 #define BUFSIZE2 ((BUFSIZE1/2) - 8) 
                      int main(int argc, char **argv) { char *buf1R1; char *buf2R1; char *buf1R2; buf1R1 = (char *) malloc(BUFSIZE2); buf2R1 = (char *) malloc(BUFSIZE2); free(buf1R1); free(buf2R1); buf1R2 = (char *) malloc(BUFSIZE1); strncpy(buf1R2, argv[1], BUFSIZE1-1); free(buf2R1); free(buf1R2); }

Real-world examples:
  - CVE-2006-5051: Chain: Signal handler contains too much functionality (CWE-828), introducing a race condition (CWE-362) that leads to a double free (CWE-415).
  - CVE-2004-0642: Double free resultant from certain error conditions.
  - CVE-2004-0772: Double free resultant from certain error conditions.
  - CVE-2005-1689: Double free resultant from certain error conditions.
  - CVE-2003-0545: Double free from invalid ASN.1 encoding.
CWE-419: Unprotected Primary Channel

Description:
The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-923

Consequences:
  - Access Control: Gain Privileges or Assume Identity

Mitigations:
  - [Architecture and Design] Do not expose administrative functionnality on the user UI.
  - [Architecture and Design] Protect the administrative/restricted functionality with a strong authentication mechanism.
CWE-42: Path Equivalence: 'filename.' (Trailing Dot)

Description:
The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-41, CWE-162

Consequences:
  - Access Control: Bypass Protection Mechanism

Real-world examples:
  - CVE-2000-1114: Source code disclosure using trailing dot
  - CVE-2002-1986: Source code disclosure using trailing dot
  - CVE-2004-2213: Source code disclosure using trailing dot
  - CVE-2005-3293: Source code disclosure using trailing dot
  - CVE-2004-0061: Bypass directory access restrictions using trailing dot in URL
CWE-420: Unprotected Alternate Channel

Description:
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-923

Consequences:
  - Access Control: Gain Privileges or Assume Identity

Mitigations:
  - [Architecture and Design] Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.

Demonstrative examples:
Register SECURE_ME is located at address 0xF00. A
                 mirror of this register called COPY_OF_SECURE_ME is
                 at location 0x800F00. The register SECURE_ME is
                 protected from malicious agents and only allows
                 access to select, while COPY_OF_SECURE_ME is not. 
                
                
                 Access control is implemented using an allowlist (as
                 indicated by acl_oh_allowlist). The identity of the
                 initiator of the transaction is indicated by the
                 one hot input, incoming_id. This is checked against
                 the acl_oh_allowlist (which contains a list of
                 initiators that are allowed to access the asset). 
                
                
         

Real-world examples:
  - CVE-2020-8004: When the internal flash is protected by blocking access on the Data Bus (DBUS), it can still be indirectly accessed through the Instruction Bus (IBUS).
  - CVE-2002-0567: DB server assumes that local clients have performed authentication, allowing attacker to directly connect to a process to load libraries and execute commands; a socket interface also exists (another a
  - CVE-2002-1578: Product does not restrict access to underlying database, so attacker can bypass restrictions by directly querying the database.
  - CVE-2003-1035: User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing.
  - CVE-2002-1863: FTP service can not be disabled even when other access controls would require it.
CWE-421: Race Condition During Access to Alternate Channel

Description:
The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors.

Extended Description:
This creates a race condition that allows an attacker to access the channel before the authorized user does.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-420, CWE-362

Consequences:
  - Access Control: Gain Privileges or Assume Identity

Real-world examples:
  - CVE-1999-0351: FTP "Pizza Thief" vulnerability. Attacker can connect to a port that was intended for use by another client.
  - CVE-2003-0230: Product creates Windows named pipe during authentication that another attacker can hijack by connecting to it.
CWE-422: Unprotected Windows Messaging Channel ('Shatter')

Description:
The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-420, CWE-360

Consequences:
  - Access Control: Gain Privileges or Assume Identity

Mitigations:
  - [Architecture and Design] Always verify and authenticate the source of the message.

Real-world examples:
  - CVE-2002-0971: Bypass GUI and access restricted dialog box.
  - CVE-2002-1230: Gain privileges via Windows message.
  - CVE-2003-0350: A control allows a change to a pointer for a callback function using Windows message.
  - CVE-2003-0908: Product launches Help functionality while running with raised privileges, allowing command execution using Windows message to access "open file" dialog.
  - CVE-2004-0213: Attacker uses Shatter attack to bypass GUI-enforced protection for CVE-2003-0908.
CWE-424: Improper Protection of Alternate Path

Description:
The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based
Parent weaknesses: CWE-693, CWE-638

Consequences:
  - Access Control: Bypass Protection Mechanism

Mitigations:
  - [Architecture and Design] Deploy different layers of protection to implement security in depth.

Real-world examples:
  - CVE-2022-29238: Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in thos
CWE-425: Direct Request ('Forced Browsing')

Description:
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-862, CWE-862, CWE-288, CWE-424

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Architecture and Design] Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
  - [Architecture and Design] Consider using MVC based frameworks such as Struts.

Demonstrative examples:
If forced browsing is possible, an attacker may be able to directly access a sensitive page by entering a URL similar to the following.

http://somesite.com/someapplication/admin.jsp

Real-world examples:
  - CVE-2022-29238: Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in thos
  - CVE-2004-2144: Bypass authentication via direct request.
  - CVE-2005-1892: Infinite loop or infoleak triggered by direct requests.
  - CVE-2004-2257: Bypass auth/auth via direct request.
  - CVE-2005-1688: Direct request leads to infoleak by error.
CWE-428: Unquoted Search Path or Element

Description:
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

Extended Description:
If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-668, CWE-668

Consequences:
  - Confidentiality: Execute Unauthorized Code or Commands

Mitigations:
  - [Implementation] Properly quote the full search path before executing a program on the system.
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i

Demonstrative examples:
The following example demonstrates the weakness.

UINT errCode = WinExec( "C:\\Program Files\\Foo\\Bar", SW_SHOW );

Real-world examples:
  - CVE-2005-1185: Small handful of others. Program doesn't quote the "C:\Program Files\" path when calling a program to be executed - or any other path with a directory or file whose name contains a space - so attacker
  - CVE-2005-2938: CreateProcess() and CreateProcessAsUser() can be misused by applications to allow "program.exe" style attacks in C:
  - CVE-2000-1128: Applies to "Common Files" folder, with a malicious common.exe, instead of "Program Files"/program.exe.
CWE-43: Path Equivalence: 'filename....' (Multiple Trailing Dot)

Description:
The product accepts path input in the form of multiple trailing dot ('filedir....') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-42, CWE-163

Consequences:
  - Confidentiality: Read Files or Directories

Real-world examples:
  - CVE-2004-0281: Multiple trailing dot allows directory listing
CWE-430: Deployment of Wrong Handler

Description:
The wrong "handler" is assigned to process an object.

Extended Description:
An example of deploying the wrong handler would be calling a servlet to reveal source code of a .JSP file, or automatically "determining" type of the object even if it is contradictory to an explicitly specified type.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-691

Consequences:
  - Integrity: Varies by Context

Mitigations:
  - [Architecture and Design] Perform a type check before interpreting an object.
  - [Architecture and Design] Reject any inconsistent types, such as a file with a .GIF extension that appears to consist of PHP code.

Real-world examples:
  - CVE-2001-0004: Source code disclosure via manipulated file extension that causes parsing by wrong DLL.
  - CVE-2002-0025: Web browser does not properly handle the Content-Type header field, causing a different application to process the document.
  - CVE-2000-1052: Source code disclosure by directly invoking a servlet.
  - CVE-2002-1742: Arbitrary Perl functions can be loaded by calling a non-existent function that activates a handler.
CWE-431: Missing Handler

Description:
A handler is not available or implemented.

Extended Description:
When an exception is thrown and not caught, the process has given up an opportunity to decide if a given failure or event is worth a change in execution.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-691

Consequences:
  - Other: Varies by Context

Mitigations:
  - [Implementation] Handle all possible situations (e.g. error condition).
  - [Implementation] If an operation can throw an Exception, implement a handler for that specific exception.

Demonstrative examples:
If a Servlet does not catch all exceptions, it may reveal debugging information that will help an adversary form a plan of attack. In the following method a DNS lookup failure will cause the Servlet to throw an exception.
When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker.
protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException { String ip = req.getRemoteAddr(); InetAddress addr = InetAddress.getByName(ip); ... out.println("hello " + addr.getHostName()); }

Real-world examples:
  - CVE-2022-25302: SDK for OPC Unified Architecture (OPC UA) is missing a handler for when a cast fails, allowing for a crash
CWE-432: Dangerous Signal Handler not Disabled During Sensitive Operations

Description:
The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running.

Extended Description:
During the execution of a signal handler, it can be interrupted by another handler when a different signal is sent. If the two handlers share state - such as global variables - then an attacker can corrupt the state by sending another signal before the first handler has completed execution.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-364

Consequences:
  - Integrity: Modify Application Data

Mitigations:
  - [Implementation] Turn off dangerous handlers when performing sensitive operations.
CWE-433: Unparsed Raw Web Content Delivery

Description:
The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.

Extended Description:
If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does not have a handler for that extension, then the server will likely send the contents of the file directly to the requester without the pre-processing that was expected. When that file contains sensitive information such as database credentials, this may allow the attacker to compromise the application or associated components.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-219

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Architecture and Design] Perform a type check before interpreting files.
  - [Architecture and Design] Do not store sensitive information in files which may be misinterpreted.

Demonstrative examples:
The following code uses an include file to store database credentials:
database.inc
<?php $dbName = 'usersDB'; $db[CREDENTIAL_REDACTED]'; ?>
<?php include('database.inc'); $db = connectToDB($dbName, $dbPassword); $db.authenticateUser($username, $password); ?>

Real-world examples:
  - CVE-2002-1886: ".inc" file stored under web document root and returned unparsed by the server
  - CVE-2002-2065: ".inc" file stored under web document root and returned unparsed by the server
  - CVE-2005-2029: ".inc" file stored under web document root and returned unparsed by the server
  - CVE-2001-0330: direct request to .pl file leaves it unparsed
  - CVE-2002-0614: .inc file
CWE-435: Improper Interaction Between Multiple Correctly-Behaving Entities

Description:
An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

Extended Description:
When a system or process combines multiple independent components, this often produces new, emergent behaviors at the system level.  However, if the interactions between these components are not fully accounted for, some of the emergent behaviors can be incorrect or even insecure.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
The paper "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection" [REF-428] shows that OSes varied widely in how they manage unusual packets, which made it difficult or impossible for intrusion detection systems to properly detect certain attacker manipulations that took advantage of these OS differences.

Real-world examples:
  - CVE-2002-0485: Anti-virus product allows bypass via Content-Type and Content-Disposition headers that are mixed case, which are still processed by some clients.
  - CVE-2003-0411: chain: Code was ported from a case-sensitive Unix platform to a case-insensitive Windows platform where filetype handlers treat .jsp and .JSP as different extensions. JSP source code may be read becau