deardaniel/secdata-raw huggingface dataset:
CWE-111: Direct Use of Unsafe JNI

Description:
When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java.

Extended Description:
Many safety features that programmers may take for granted do not apply for native code, so you must carefully review all such code for potential problems. The languages used to implement native code may be more susceptible to buffer overflows and other attacks. Native code is unprotected by the security features enforced by the runtime environment, such as strong typing and array bounds checking.

Affected languages: Java
Parent weaknesses: CWE-695, CWE-20

Consequences:
  - Access Control: Bypass Protection Mechanism

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Implement error handling around the JNI call.
  - [Implementation] Do not use JNI calls if you don't trust the native library.
  - [Implementation] Be reluctant to use JNI calls. A Java API equivalent may exist.

Demonstrative examples:
The following code defines a class named Echo. The class declares one native method (defined below), which uses C to echo commands entered on the console back to the user. The following C code defines the native method implemented in the Echo class:
Because the example is implemented in Java, it may appear that it is immune to memory issues like buffer overflow vulnerabilities. Although Java does do a good job of making memory operations safe, this protection does not extend to vulnerabilities occurring in source code written in other languages that are accessed using the Java Native Interface. Despite the memory protections offered in Java, the C code in this example is vulnerable to a buffer overflow because it makes use of gets(), which does not check the length of its input.
class Echo
CWE-1110: Incomplete Design Documentation

Description:
The product's design documentation does not adequately describe
					control flow, data flow, system initialization, relationships between tasks,
					components, rationales, or other important aspects of the
					design.
Affected technologies: Not Technology-Specific, ICS/OT
Parent weaknesses: CWE-1059

Consequences:
  - Other: Reduce Maintainability
  - Other: Increase Analytical Complexity
CWE-1111: Incomplete I/O Documentation

Description:
The product's documentation does not adequately define inputs,
					outputs, or system/software interfaces.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1059

Consequences:
  - Other: Reduce Maintainability
  - Other: Increase Analytical Complexity
CWE-1112: Incomplete Documentation of Program Execution

Description:
The document does not fully define all mechanisms that are used
					to control or influence how product-specific programs are
					executed.

Extended Description:
This includes environmental variables, configuration files, registry keys, command-line switches or options, or system settings.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1059

Consequences:
  - Other: Reduce Maintainability
  - Other: Increase Analytical Complexity
CWE-1113: Inappropriate Comment Style

Description:
The source code uses comment styles or formats that are
					inconsistent or do not follow expected standards for the
					product.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1078

Consequences:
  - Other: Reduce Maintainability
  - Other: Increase Analytical Complexity
CWE-1114: Inappropriate Whitespace Style

Description:
The source code contains whitespace that is inconsistent across
					the code or does not follow expected standards for the
					product.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1078

Consequences:
  - Other: Increase Analytical Complexity
  - Other: Reduce Maintainability

Real-world examples:
  - CVE-2014-1266: Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-56
CWE-1115: Source Code Element without Standard Prologue

Description:
The source code contains elements such as source files 
					that do not consistently provide a prologue or header that has been
					standardized for the project.

Extended Description:
Standard prologues or headers may contain information such as module name, version number, author, date, purpose, function, assumptions, limitations, accuracy considerations, etc.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1078

Consequences:
  - Other: Reduce Maintainability
  - Other: Increase Analytical Complexity
CWE-1116: Inaccurate Source Code Comments

Description:
The source code contains comments that do not accurately
					describe or explain aspects of the portion of the code with which the comment is
					associated.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1078

Consequences:
  - Other: Reduce Maintainability
  - Other: Increase Analytical Complexity

Mitigations:
  - [Implementation] Verify that each comment accurately reflects what is intended to happen during execution of the code.

Demonstrative examples:
In the following Java example the code performs a calculation to determine how much medicine to administer. A comment is provided to give insight into what the calculation shoud be doing. Unfortunately the comment does not match the actual code and thus leaves the reader to wonder which is correct.
In the correction below, the code functionality has been verified, and the comment has been corrected to reflect the proper calculation.
public class Main { 
                  
		   public static void main(String[] args) {
                    
		     int pt_weight = 83; 
		     int mg_per_kg = 3; 
		     int daily_dose = 0; 
		      
		     // Add the patient weight and Mg/Kg to calculate the correct daily dose 
		     daily_dose = pt_weight * mg_per_kg; 
                     return dosage;
CWE-1117: Callable with Insufficient Behavioral Summary

Description:
The code contains a function or method whose signature and/or associated
					inline documentation does not sufficiently describe the callable's inputs, outputs,
					side effects, assumptions, or return codes.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1078

Consequences:
  - Other: Reduce Maintainability
CWE-1118: Insufficient Documentation of Error Handling Techniques

Description:
The documentation does not sufficiently describe the techniques
					that are used for error handling, exception processing, or similar
					mechanisms.

Extended Description:
Documentation may need to cover error handling techniques at multiple layers, such as module, executable, compilable code unit, or callable.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1059

Consequences:
  - Other: Reduce Maintainability
CWE-1119: Excessive Use of Unconditional Branching

Description:
The code uses too many unconditional branches (such as
					"goto").

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Maintainability
CWE-112: Missing XML Validation

Description:
The product accepts XML from an untrusted source but does not validate the XML against the proper schema.

Extended Description:
Most successful attacks begin with a violation of the programmer's assumptions. By accepting an XML document without validating it against a DTD or XML schema, the programmer leaves a door open for attackers to provide unexpected, unreasonable, or malicious input.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1286, CWE-20

Consequences:
  - Integrity: Unexpected State

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Always validate XML input against a known XML Schema or DTD. 
                   It is not possible for an XML parser to validate all aspects of a document's content because a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checkin

Demonstrative examples:
The following code loads and parses an XML file.
The XML file is loaded without validating it against a known XML Schema or DTD.
// Read DOM 
                      try { ... DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); factory.setValidating( false ); .... c_dom = factory.newDocumentBuilder().parse( xmlFile ); } catch(Exception ex) { ... }

The following code creates a DocumentBuilder object to be used in building an XML document.
The DocumentBuilder object does not validate an XML document against a schema, making it possible to create an invalid XML document.
DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance(); builderFactory.setNamespaceAware(true); DocumentBuilder builder = builderFactory.newDocumentBuilder();
CWE-1120: Excessive Code Complexity

Description:
The code is too complex, as calculated using a well-defined,
					quantitative measure.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability
  - Other: Reduce Performance

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1121: Excessive McCabe Cyclomatic Complexity

Description:
The code contains McCabe cyclomatic complexity that exceeds a
	desirable maximum.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1122: Excessive Halstead Complexity

Description:
The code is structured in a way that a Halstead complexity
					measure exceeds a desirable maximum.

Extended Description:
A variety of Halstead complexity measures exist, such as program vocabulary size or volume.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Maintainability
CWE-1123: Excessive Use of Self-Modifying Code

Description:
The product uses too much self-modifying code.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Maintainability
CWE-1124: Excessively Deep Nesting

Description:
The code contains a callable or other code grouping in which
					the nesting / branching is too deep.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Maintainability
CWE-1125: Excessive Attack Surface

Description:
The product has an attack surface whose quantitative
					measurement exceeds a desirable maximum.

Extended Description:
Originating from software security, an "attack surface" measure typically reflects the number of input points and output points that can be utilized by an untrusted party, i.e. a potential attacker. A larger attack surface provides more places to attack, and more opportunities for developers to introduce weaknesses.  In some cases, this measure may reflect other aspects of quality besides security; e.g., a product with many inputs and outputs may require a large number of tests in order to improve code coverage.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Varies by Context
CWE-1126: Declaration of Variable with Unnecessarily Wide Scope

Description:
The source code declares a variable in one scope, but the
					variable is only used within a narrower scope.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1127: Compilation with Insufficient Warnings or Errors

Description:
The code is compiled without sufficient warnings enabled, which
					may prevent the detection of subtle bugs or quality
					issues.

Affected languages: Compiled, Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Manual Analysis: Inspect scripts and tools that invoke the
	     compiler. Ensure that the appropriate command line
	     switches and/or configuration are specified to report
	     warnings and errors.
CWE-115: Misinterpretation of Input

Description:
The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-436

Consequences:
  - Integrity: Unexpected State

Detection methods:
  - Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with rand

Real-world examples:
  - CVE-2005-2225: Product sees dangerous file extension in free text of a group discussion, disconnects all users.
  - CVE-2001-0003: Product does not correctly import and process security settings from another product.
CWE-1164: Irrelevant Code

Description:
The product contains code that is not essential for execution,
	     i.e. makes no state changes and has no side effects that alter
	     data or control flow, such that removal of the code would have no impact
	     to functionality or correctness.

Extended Description:
Irrelevant code could include dead code,
	     initialization that is not used, empty blocks, code that could be entirely
	     removed due to optimization, etc.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Reliability
  - Other: Reduce Performance

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
The condition for the second if statement is impossible to satisfy. It requires that the variables be non-null. However, on the only path where s can be assigned a non-null value, there is a return statement.

String s = null; if (b) { s = "Yes"; return; } 
                      if (s != null) { Dead(); }

The following code excerpt assigns to the variable r and then overwrites the value without using it.

r = getName(); r = getNewBuffer(buf);

Real-world examples:
  - CVE-2014-1266: Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-56
CWE-117: Improper Output Neutralization for Logs

Description:
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-116, CWE-20

Consequences:
  - Integrity: Modify Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or au
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i

Demonstrative examples:
The following web application code attempts to read an integer value from a request object. If the parseInt call fails, then the input is logged with an error message indicating what happened.
If a user submits the string "twenty-one" for val, the following entry is logged:
String val = request.getParameter("val"); try { 
                         
                            int value = Integer.parseInt(val); 
                      } catch (NumberFormatException) { log.info("Failed to parse val = " + val); } ...

Real-world examples:
  - CVE-2006-4624: Chain: inject fake log entries with fake timestamps using CRLF injection
CWE-1173: Improper Use of Validation Framework

Description:
The product does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library.

Extended Description:
Many modern coding languages provide developers with input validation frameworks to make the task of input validation easier and less error-prone. These frameworks will automatically check all input against specified criteria and direct execution to error handlers when invalid input is received. The improper use (i.e., an incorrect implementation or missing altogether) of these frameworks is not directly exploitable, but can lead to an exploitable condition if proper input validation is not performed later in the product. Not using provided input validation frameworks can also hurt the maintainability of code as future developers may not recognize the downstream input validation being used in the place of the validation framework.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-20

Consequences:
  - Integrity: Unexpected State

Detection methods:
  - Automated Static Analysis: Some instances of improper input validation can be detected using automated static analysis. 
                   A static analysis tool might allow the user to specify which application-specific metho

Mitigations:
  - [Implementation] Properly use provided input validation frameworks.
CWE-1174: ASP.NET Misconfiguration: Improper Model Validation

Description:
The ASP.NET application does not use, or incorrectly uses, the model validation framework.

Affected languages: ASP.NET
Parent weaknesses: CWE-1173

Consequences:
  - Integrity: Unexpected State
CWE-1176: Inefficient CPU Computation

Description:
The product performs CPU computations using
         algorithms that are not as efficient as they could be for the
         needs of the developer, i.e., the computations can be
         optimized further.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-405

Consequences:
  - Availability: Reduce Performance

Real-world examples:
  - CVE-2022-37734: Chain: lexer in Java-based GraphQL server does not enforce maximum of tokens early enough (CWE-696), allowing excessive CPU consumption (CWE-1176)
CWE-1177: Use of Prohibited Code

Description:
The product uses a function, library, or third party component
	     that has been explicitly prohibited, whether by the developer or
	     the customer.

Extended Description:
The developer - or customers - may wish to restrict or eliminate use of a function, library, or third party component for any number of reasons, including real or suspected vulnerabilities; difficulty to use securely; export controls or license requirements; obsolete or poorly-maintained code; internal code being scheduled for deprecation; etc. 
	  To reduce risk of vulnerabilities, the developer might maintain a list of "banned" functions that programmers must avoid using because the functions are difficult or impossible to use securely.  This issue can also make the product more costly and difficult to maintain.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Build and Compilation] Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's SDL. 

Demonstrative examples:
The code below calls the gets() function to read in data from the command line.
However, gets() is inherently unsafe, because it copies all input from STDIN to the buffer without checking size. This allows the user to provide a string that is larger than the buffer size, resulting in an overflow condition.
char buf[24]; printf("Please enter your name and press <Enter>\n"); gets(buf); ... }

The following code attempts to create a local copy of a buffer to perform some manipulations to the data.
However, the programmer does not ensure that the size of the data pointed to by string will fit in the local buffer and copies the data with the potentially dangerous strcpy() function. This may result in a buffer overflow condition if an attacker can influence the contents of the string parameter.
void manipulate_string(char * string){ char buf[24]; strcpy(buf, string); ... }

Real-world examples:
  - CVE-2007-1470: Library has multiple buffer overflows using sprintf() and strcpy()
  - CVE-2007-4004: FTP client uses inherently insecure gets() function and is setuid root on some systems, allowing buffer overflow
CWE-118: Incorrect Access of Indexable Resource ('Range Error')

Description:
The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-664

Consequences:
  - Other: Varies by Context