deardaniel/secdata-raw huggingface dataset:
MITRE CAPEC-691: Spoof Open-Source Software Metadata

Description:
An adversary spoofs open-source software metadata in an attempt to masquerade malicious software as popular, maintained, and trusted.

Mitigations:
  - Before downloading open-source software, perform precursory metadata checks to determine the author(s), frequency of updates, when the software was last updated, and if the software is widely leverage
  - Within package managers, look for conflicting or non-unique repository references to determine if multiple packages share the same repository reference.
  - Reference vulnerability databases to determine if the software contains known vulnerabilities.

Related CWEs: 494
MITRE CAPEC-692: Spoof Version Control System Commit Metadata

Description:
An adversary spoofs metadata pertaining to a Version Control System (VCS) (e.g., Git) repository's commits to deceive users into believing that the maliciously provided software is frequently maintained and originates from a trusted source.

Mitigations:
  - Before downloading open-source software, perform precursory metadata checks to determine the author(s), frequency of updates, when the software was last updated, and if the software is widely leverage
  - Reference vulnerability databases to determine if the software contains known vulnerabilities.
  - Only download open-source software from reputable hosting sites or package managers.

Related CWEs: 494
MITRE CAPEC-693: StarJacking

Description:
An adversary spoofs software popularity metadata to deceive users into believing that a maliciously provided package is widely used and originates from a trusted source.

Mitigations:
  - Before downloading open-source packages, perform precursory metadata checks to determine the author(s), frequency of updates, when the software was last updated, and if the software is widely leverage
  - Look for conflicting or non-unique repository references to determine if multiple packages share the same repository reference.
  - Reference vulnerability databases to determine if the software contains known vulnerabilities.

Related CWEs: 494
MITRE CAPEC-694: System Location Discovery

Description:
An adversary collects information about the target system in an attempt to identify the system's geographical location. 
             Information gathered could include keyboard layout, system language, and timezone. This information may benefit an adversary in confirming the desired target and/or tailoring further attacks.

Mitigations:
  - To reduce the amount of information gathered, one could disable various geolocation features of the operating system not required for system operation.

Related CWEs: 497
MITRE CAPEC-695: Repo Jacking

Description:
An adversary takes advantage of the redirect property of directly linked Version Control System (VCS) repositories to trick users into incorporating malicious code into their applications.

Mitigations:
  - Leverage dedicated package managers instead of directly linking to VCS repositories.
  - Utilize version pinning and lock files to prevent use of maliciously modified repositories.
  - Implement "vendoring" (i.e., including third-party dependencies locally) and leverage automated testing techniques (e.g., static analysis) to determine if the software behaves maliciously.

Related CWEs: 494, 829
MITRE CAPEC-696: Load Value Injection

Description:
An adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution in which a faulting or assisted load instruction transiently forwards adversary-controlled data from microarchitectural buffers. By inducing a page fault or microcode assist during victim execution, an adversary can force legitimate victim execution to operate on the adversary-controlled data which is stored in the microarchitectural buffers. The adversary can then use existing code gadgets and side channel analysis to discover victim secrets that have not yet been flushed from microarchitectural state or hijack the system control flow.

Mitigations:
  - Do not allow the forwarding of data resulting from a faulting or assisted instruction. Some current mitigations claim to zero out the forwarded data, but this mitigation still does not suffice.
  - Insert explicit “lfence” speculation barriers in software before potentially faulting or assisted loads. This halts transient execution until all previous instructions have been executed and ensures t

Related CWEs: 1342
MITRE CAPEC-697: DHCP Spoofing

Description:
An adversary masquerades as a legitimate Dynamic Host Configuration Protocol (DHCP) server by spoofing DHCP traffic, with the goal of redirecting network traffic or denying service to DHCP.

Mitigations:
  - Design: MAC-Forced Forwarding
  - Implementation: Port Security and DHCP snooping
  - Implementation: Network-based Intrusion Detection Systems

Related CWEs: 923
MITRE CAPEC-698: Install Malicious Extension

Description:
An adversary directly installs or tricks a user into installing a malicious extension into existing trusted software, with the goal of achieving a variety of negative technical impacts.

Mitigations:
  - Only install extensions/plugins from official/verifiable sources.
  - Confirm extensions/plugins are legitimate and not malware masquerading as a legitimate extension/plugin.
  - Ensure the underlying software leveraging the extension/plugin (including operating systems) is up-to-date.

Related CWEs: 507, 829
MITRE CAPEC-699: Eavesdropping on a Monitor

Description:
An Adversary can eavesdrop on the content of an external monitor through the air without modifying any cable or installing software, just capturing this signal emitted by the cable or video port, with this the attacker will be able to impact the confidentiality of the data without being detected by traditional security tools

Mitigations:
  - Enhance: Increase the number of electromagnetic shield layers in the display ports and cables to contain or reduce the intensity of the leaked signal.
  - Implement: Use a protocol that encrypts the video signal; in case the signal is intercepted the signal is protected by the encryption.
  - Design: Lock away the video cables, making it difficult for the attacker to access the cables and place the antenna near them (If the distance condition between the antenna and display port/cable is n

Related CWEs: 1300
MITRE CAPEC-7: Blind SQL Injection

Description:
Blind SQL Injection results from an insufficient mitigation for SQL Injection. Although suppressing database error messages are considered best practice, the suppression alone is not sufficient to prevent SQL Injection. Blind SQL Injection is a form of SQL Injection that overcomes the lack of error messages. Without the error messages that facilitate SQL Injection, the adversary constructs input strings that probe the target through simple Boolean SQL expressions. The adversary can determine if the syntax and structure of the injection was successful based on whether the query was executed or not. Applied iteratively, the adversary determines how and where the target is vulnerable to SQL Injection.

Mitigations:
  - Security by Obscurity is not a solution to preventing SQL Injection. Rather than suppress error messages and exceptions, the application must handle them gracefully, returning either a custom error pa
  - Strong input validation - All user-controllable input must be validated and filtered for illegal characters as well as SQL content. Keywords such as UNION, SELECT or INSERT must be filtered in additio

Related CWEs: 89, 209, 74, 20, 697, 707
MITRE CAPEC-70: Try Common or Default Usernames and Passwords

Description:
An adversary may try certain common or default usernames and passwords to gain access into the system and perform unauthorized actions. An adversary may try an intelligent brute force using empty passwords, known vendor default credentials, as well as a dictionary of common usernames and passwords. Many vendor products come preconfigured with default (and thus well-known) usernames and passwords that should be deleted prior to usage in a production environment. It is a common mistake to forget to remove these default login credentials. Another problem is that users would pick very simple (common) passwords (e.g. "secret" or "password") that make it easier for the attacker to gain access to the system compared to using a brute force attack or even a dictionary attack using a full dictionary.

Mitigations:
  - Delete all default account credentials that may be put in by the product vendor.
  - Implement a password throttling mechanism. This mechanism should take into account both the IP address and the log in name of the user.
  - Put together a strong password policy and make sure that all user created passwords comply with it. Alternatively automatically generate strong passwords for users.

Related CWEs: 521, 262, 263, 798, 654, 308, 309
MITRE CAPEC-700: Network Boundary Bridging

Description:
An adversary which has gained elevated access to network boundary devices may use these devices to create a channel to bridge trusted and untrusted networks. Boundary devices do not necessarily have to be on the network’s edge, but rather must serve to segment portions of the target network the adversary wishes to cross into.

Mitigations:
  - Design: Ensure network devices are storing credentials in encrypted stores
  - Design: Follow the principle of least privilege and restrict administrative duties to as few accounts as possible. Ensure these privileged accounts are secured with strong credentials which do not ove
  - Configuration: When possible, configure network boundary devices to use MFA.
MITRE CAPEC-701: Browser in the Middle (BiTM)

Description:
An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote desktop session that the victim can access.

Mitigations:
  - Implementation: Use strong, mutual authentication to fully authenticate with both ends of any communications channel

Related CWEs: 294, 345
MITRE CAPEC-702: Exploiting Incorrect Chaining or Granularity of Hardware Debug Components

Description:
An adversary exploits incorrect chaining or granularity of hardware debug components in order to gain unauthorized access to debug functionality on a chip. This happens when authorization is not checked on a per function basis and is assumed for a chain or group of debug functionality.

Mitigations:
  - Implement: Ensure that debug components are properly chained, and their granularity is maintained at different authorization levels
  - Perform Post-silicon validation tests at various authorization levels to ensure that debug components are only accessible to authorized users

Related CWEs: 1296
MITRE CAPEC-71: Using Unicode Encoding to Bypass Validation Logic

Description:
An attacker may provide a Unicode string to a system component that is not Unicode aware and use that to circumvent the filter or cause the classifying mechanism to fail to properly understanding the request. That may allow the attacker to slip malicious data past the content filter and/or possibly cause the application to route the request incorrectly.

Mitigations:
  - Ensure that the system is Unicode aware and can properly process Unicode data. Do not make an assumption that data will be in ASCII.
  - Ensure that filtering or input validation is applied to canonical data.
  - Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should 

Related CWEs: 176, 179, 180, 173, 172, 184, 183, 74, 20, 697
MITRE CAPEC-72: URL Encoding

Description:
This attack targets the encoding of the URL. An adversary can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL.

Mitigations:
  - Refer to the RFCs to safely decode URL.
  - Regular expression can be used to match safe URL patterns. However, that may discard valid URL requests if the regular expression is too restrictive.
  - There are tools to scan HTTP requests to the server for valid URL such as URLScan from Microsoft (http://www.microsoft.com/technet/security/tools/urlscan.mspx).

Related CWEs: 173, 177, 172, 73, 74, 20
MITRE CAPEC-73: User-Controlled Filename

Description:
An attack of this type involves an adversary inserting malicious characters (such as a XSS redirection) into a filename, directly or indirectly that is then used by the target software to generate HTML text or other potentially executable content. Many websites rely on user-generated content and dynamically build resources like files, filenames, and URL links directly from user supplied data. In this attack pattern, the attacker uploads code that can execute in the client browser and/or redirect the client browser to a site that the attacker owns. All XSS attack payload variants can be used to pass and exploit these vulnerabilities.

Mitigations:
  - Design: Use browser technologies that do not allow client side scripting.
  - Implementation: Ensure all content that is delivered to client is sanitized against an acceptable content specification.
  - Implementation: Perform input validation for all remote content.

Related CWEs: 20, 184, 96, 348, 116, 350, 86, 697
MITRE CAPEC-74: Manipulating State

Description:
The adversary modifies state information maintained by the target software or causes a state transition in hardware. If successful, the target will use this tainted state and execute in an unintended manner. 
             State management is an important function within a software application. User state maintained by the application can include usernames, payment information, browsing history as well as application-specific contents such as items in a shopping cart. Manipulating user state can be employed by an adversary to elevate privilege, conduct fraudulent transactions or otherwise modify the flow of the application to derive certain benefits. 
             If there is a hardware logic error in a finite state machine, the adversary can use this to put the system in an undefined state which could cause a denial of service or exposure of secure data.

Mitigations:
  - Do not rely solely on user-controllable locations, such as cookies or URL parameters, to maintain user state.
  - Avoid sensitive information, such as usernames or authentication and authorization information, in user-controllable locations.
  - Sensitive information that is part of the user state must be appropriately protected to ensure confidentiality and integrity at each request.

Related CWEs: 372, 315, 353, 693, 1245, 1253, 1265, 1271
MITRE CAPEC-75: Manipulating Writeable Configuration Files

Description:
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.

Mitigations:
  - Design: Enforce principle of least privilege
  - Design: Backup copies of all configuration files
  - Implementation: Integrity monitoring for configuration files

Related CWEs: 349, 99, 77, 346, 353, 354
MITRE CAPEC-76: Manipulating Web Input to File System Calls

Description:
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

Mitigations:
  - Design: Enforce principle of least privilege.
  - Design: Ensure all input is validated, and does not contain file system commands
  - Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.

Related CWEs: 23, 22, 73, 77, 346, 348, 285, 272, 59, 74
MITRE CAPEC-77: Manipulating User-Controlled Variables

Description:
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

Mitigations:
  - Do not allow override of global variables and do Not Trust Global Variables. 
                If the register_globals option is enabled, PHP will create global variables for each GET, POST, and cookie
  - A software system should be reluctant to trust variables that have been initialized outside of its trust boundary. Ensure adequate checking is performed when relying on input from outside a trust boun
  - Separate the presentation layer and the business logic layer. Variables at the business logic layer should not be exposed at the presentation layer. This is to prevent computation of business logic fr

Related CWEs: 15, 94, 96, 285, 302, 473, 1321
MITRE CAPEC-78: Using Escaped Slashes in Alternate Encoding

Description:
This attack targets the use of the backslash in alternate encoding. An adversary can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the adversary tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack.

Mitigations:
  - Verify that the user-supplied data does not use backslash character to escape malicious characters.
  - Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should 
  - Be aware of the threat of alternative method of data encoding.

Related CWEs: 180, 181, 173, 172, 73, 22, 74, 20, 697, 707
MITRE CAPEC-79: Using Slashes in Alternate Encoding

Description:
This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the adversary many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.

Mitigations:
  - Any security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data 
  - When client input is required from web-based forms, avoid using the "GET" method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use th
  - There are tools to scan HTTP requests to the server for valid URL such as URLScan from Microsoft (http://www.microsoft.com/technet/security/tools/urlscan.mspx)

Related CWEs: 173, 180, 181, 20, 74, 73, 22, 185, 200, 697
MITRE CAPEC-8: Buffer Overflow in an API Call

Description:
This attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An adversary who has knowledge of known vulnerable libraries or shared code can easily target software that makes use of these libraries. All clients that make use of the code library thus become vulnerable by association. This has a very broad effect on security across a system, usually affecting more than one software process.

Mitigations:
  - Use a language or compiler that performs automatic bounds checking.
  - Use secure functions not vulnerable to buffer overflow.
  - If you have to use dangerous functions, make sure that you do boundary checking.

Related CWEs: 120, 119, 118, 74, 20, 680, 733, 697
MITRE CAPEC-80: Using UTF-8 Encoding to Bypass Validation Logic

Description:
This attack is a specific variation on leveraging alternate encodings to bypass validation logic. This attack leverages the possibility to encode potentially harmful input in UTF-8 and submit it to applications not expecting or effective at validating this encoding standard making input filtering difficult. UTF-8 (8-bit UCS/Unicode Transformation Format) is a variable-length character encoding for Unicode. Legal UTF-8 characters are one to four bytes long. However, early version of the UTF-8 specification got some entries wrong (in some cases it permitted overlong characters). UTF-8 encoders are supposed to use the "shortest possible" encoding, but naive decoders may accept encodings that are longer than necessary. According to the RFC 3629, a particularly subtle form of this attack can be carried out against a parser which performs security-critical validity checks against the UTF-8 encoded form of its input, but interprets certain illegal octet sequences as characters.

Mitigations:
  - The Unicode Consortium recognized multiple representations to be a problem and has revised the Unicode Standard to make multiple representations of the same code point with UTF-8 illegal. The UTF-8 Co
  - The exact response required from an UTF-8 decoder on invalid input is not uniformly defined by the standards. In general, there are several ways a UTF-8 decoder might behave in the event of an invalid
  - For security reasons, a UTF-8 decoder must not accept UTF-8 sequences that are longer than necessary to encode a character. If you use a parser to decode the UTF-8 encoding, make sure that parser filt

Related CWEs: 173, 172, 180, 181, 73, 74, 20, 697, 692
MITRE CAPEC-81: Web Server Logs Tampering

Description:
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.

Mitigations:
  - Design: Use input validation before writing to web log
  - Design: Validate all log data before it is output

Related CWEs: 117, 93, 75, 221, 96, 20, 150, 276, 279, 116
MITRE CAPEC-83: XPath Injection

Description:
An attacker can craft special user-controllable input consisting of XPath expressions to inject the XML database and bypass authentication or glean information that they normally would not be able to. XPath Injection enables an attacker to talk directly to the XML database, thus bypassing the application completely. XPath Injection results from the failure of an application to properly sanitize input used as part of dynamic XPath expressions used to query an XML database.

Mitigations:
  - Strong input validation - All user-controllable input must be validated and filtered for illegal characters as well as content that can be interpreted in the context of an XPath expression. Characters
  - Use of parameterized XPath queries - Parameterization causes the input to be restricted to certain domains, such as strings or integers, and any input outside such domains is considered invalid and th
  - Use of custom error pages - Attackers can glean information about the nature of queries from descriptive error messages. Input validation must be coupled with customized error pages that inform about 

Related CWEs: 91, 74, 20, 707