deardaniel/secdata-raw huggingface dataset:
CWE-214: Invocation of Process Using Visible Sensitive Information

Description:
A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Extended Description:
Many operating systems allow a user to list information about processes that are owned by other users. Other users could see information such as command line arguments or environment variable settings. When this data contains sensitive information such as credentials, it might allow other users to launch an attack against the product or related resources.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-497

Consequences:
  - Confidentiality: Read Application Data

Demonstrative examples:
In the example below, the password for a keystore file is read from a system property.
If the property is defined on the command line when the program is invoked (using the -D... syntax), the password may be displayed in the OS process list.
String keystorePass = System.getProperty("javax.net.ssl.keyStorePassword"); if (keystorePass == null) { System.err.println("ERROR: Keystore password not specified."); System.exit(-1); } 
                      ...

Real-world examples:
  - CVE-2023-38994: IAM product includes LDAP password in a process call, allowing local users to obtain the password
  - CVE-2005-1387: password passed on command line
  - CVE-2005-2291: password passed on command line
  - CVE-2001-1565: username/password on command line allows local users to view via "ps" or other process listing programs
  - CVE-2004-1948: Username/password on command line allows local users to view via "ps" or other process listing programs.
CWE-215: Insertion of Sensitive Information Into Debugging Code

Description:
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

Extended Description:
When debugging, it may be necessary to report detailed information to the programmer.  However, if the debugging code is not disabled when the product is operating in a production environment, then this sensitive information may be exposed to attackers.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-200

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Do not leave debug statements that could be executed in the source code. Ensure that all debug information is eradicated before releasing the software.
  - [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. 
                   Ensure that appropriate compartm

Demonstrative examples:
The following program changes its behavior based on a debug flag.
The code writes sensitive debug information to the client browser if the "debugEnabled" flag is set to true .
<% if (Boolean.getBoolean("debugEnabled")) { 
                         %> User account number: <%= acctNo %> <% } %>

Real-world examples:
  - CVE-2004-2268: Password exposed in debug information.
  - CVE-2002-0918: CGI script includes sensitive information in debug messages when an error is triggered.
  - CVE-2003-1078: FTP client with debug option enabled shows password to the screen.
CWE-219: Storage of File with Sensitive Data Under Web Root

Description:
The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.

Extended Description:
Besides public-facing web pages and code, products may store sensitive data, code that is not directly invoked, or other files under the web document root of the web server.  If the server is not configured or otherwise used to prevent direct access to those files, then attackers may obtain this sensitive data.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-552

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Implementation] Avoid storing information under the web root directory.
  - [System Configuration] Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the web directory.

Real-world examples:
  - CVE-2005-1835: Data file under web root.
  - CVE-2005-2217: Data file under web root.
  - CVE-2002-1449: Username/password in data file under web root.
  - CVE-2002-0943: Database file under web root.
  - CVE-2005-1645: database file under web root.
CWE-220: Storage of File With Sensitive Data Under FTP Root

Description:
The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-552

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Implementation] Avoid storing information under the FTP root directory.
  - [System Configuration] Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the FTP directory.
CWE-221: Information Loss or Omission

Description:
The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-664

Consequences:
  - Non-Repudiation: Hide Activities

Demonstrative examples:
This code logs suspicious multiple login attempts.
This code only logs failed login attempts when a certain limit is reached. If an attacker knows this limit, they can stop their attack from being discovered by avoiding the limit.
function login($userName,$password){ 
                         if(authenticate($userName,$password)){ return True; } else{ incrementLoginAttempts($userName); if(recentLoginAttempts($userName) > 5){ writeLog("Failed login attempt by User: " . $userName . " at " + date('r') ); } } 
                      }

Real-world examples:
  - CVE-2004-2227: Web browser's filename selection dialog only shows the beginning portion of long filenames, which can trick users into launching executables with dangerous extensions.
  - CVE-2003-0412: application server does not log complete URI of a long request (truncation).
  - CVE-1999-1029: Login attempts are not recorded if the user disconnects before the maximum number of tries.
  - CVE-2002-0725: Attacker performs malicious actions on a hard link to a file, obscuring the real target file.
  - CVE-1999-1055: Product does not warn user when document contains certain dangerous functions or macros.
CWE-222: Truncation of Security-relevant Information

Description:
The product truncates the display, recording, or processing of security-relevant information in a way that can obscure the source or nature of an attack.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-221

Consequences:
  - Non-Repudiation: Hide Activities

Real-world examples:
  - CVE-2005-0585: Web browser truncates long sub-domains or paths, facilitating phishing.
  - CVE-2004-2032: Bypass URL filter via a long URL with a large number of trailing hex-encoded space characters.
  - CVE-2003-0412: application server does not log complete URI of a long request (truncation).
CWE-223: Omission of Security-relevant Information

Description:
The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-221

Consequences:
  - Non-Repudiation: Hide Activities

Demonstrative examples:
This code logs suspicious multiple login attempts.
This code only logs failed login attempts when a certain limit is reached. If an attacker knows this limit, they can stop their attack from being discovered by avoiding the limit.
function login($userName,$password){ 
                         if(authenticate($userName,$password)){ return True; } else{ incrementLoginAttempts($userName); if(recentLoginAttempts($userName) > 5){ writeLog("Failed login attempt by User: " . $userName . " at " + date('r') ); } } 
                      }

This code prints the contents of a file if a user has permission.
While the code logs a bad access attempt, it logs the user supplied name for the file, not the canonicalized file name. An attacker can obscure their target by giving the script the name of a link to the file they are attempting to access. Also note this code contains a race condition between the is_link() and readlink() functions (CWE-363).
function readFile($filename){ 
                         $user = getCurrentUser(); $realFile = $filename; 
                            
                            //resolve file if its a symbolic link 
                            if(is_link($filename)){ $realFile = readlink($filename); } 
                            if(fileowner($realFile) == $user){ echo file_get_contents($realFile); re

Real-world examples:
  - CVE-1999-1029: Login attempts are not recorded if the user disconnects before the maximum number of tries.
  - CVE-2002-1839: Sender's IP address not recorded in outgoing e-mail.
  - CVE-2000-0542: Failed authentication attempts are not recorded if later attempt succeeds.
CWE-224: Obscured Security-relevant Information by Alternate Name

Description:
The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-221

Consequences:
  - Non-Repudiation: Hide Activities

Demonstrative examples:
This code prints the contents of a file if a user has permission.
While the code logs a bad access attempt, it logs the user supplied name for the file, not the canonicalized file name. An attacker can obscure their target by giving the script the name of a link to the file they are attempting to access. Also note this code contains a race condition between the is_link() and readlink() functions (CWE-363).
function readFile($filename){ 
                         $user = getCurrentUser(); $realFile = $filename; 
                            
                            //resolve file if its a symbolic link 
                            if(is_link($filename)){ $realFile = readlink($filename); } 
                            if(fileowner($realFile) == $user){ echo file_get_contents($realFile); re

Real-world examples:
  - CVE-2002-0725: Attacker performs malicious actions on a hard link to a file, obscuring the real target file.
CWE-228: Improper Handling of Syntactically Invalid Structure

Description:
The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-703, CWE-707

Consequences:
  - Integrity: Unexpected State

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
This Android application has registered to handle a URL when sent an intent:
The application assumes the URL will always be included in the intent. When the URL is not present, the call to getStringExtra() will return null, thus causing a null pointer exception when length() is called.
... 
                      IntentFilter filter = new IntentFilter("com.example.URLHandler.openURL"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); 
                      ... 
                      
                      public class UrlHandlerReceiver extends BroadcastReceiver { 
                         @Override public void onReceive(Context context, Intent intent) { 
                               if("com.example.URLHandler.openURL".equals(intent.getAction())) { String URL = 

Real-world examples:
  - CVE-2004-0270: Anti-virus product has assert error when line length is non-numeric.
CWE-229: Improper Handling of Values

Description:
The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-228

Consequences:
  - Integrity: Unexpected State
CWE-230: Improper Handling of Missing Values

Description:
The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-229

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
This Android application has registered to handle a URL when sent an intent:
The application assumes the URL will always be included in the intent. When the URL is not present, the call to getStringExtra() will return null, thus causing a null pointer exception when length() is called.
... 
                      IntentFilter filter = new IntentFilter("com.example.URLHandler.openURL"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); 
                      ... 
                      
                      public class UrlHandlerReceiver extends BroadcastReceiver { 
                         @Override public void onReceive(Context context, Intent intent) { 
                               if("com.example.URLHandler.openURL".equals(intent.getAction())) { String URL = 

Real-world examples:
  - CVE-2002-0422: Blank Host header triggers resultant infoleak.
  - CVE-2000-1006: Blank "charset" attribute in MIME header triggers crash.
  - CVE-2004-1504: Blank parameter causes external error infoleak.
  - CVE-2005-2053: Blank parameter causes external error infoleak.
CWE-231: Improper Handling of Extra Values

Description:
The product does not handle or incorrectly handles when more values are provided than expected.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-229

Consequences:
  - Integrity: Unexpected State
CWE-232: Improper Handling of Undefined Values

Description:
The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-229

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
In this example, an address parameter is read and trimmed of whitespace.
If the value of the address parameter is null (undefined), the servlet will throw a NullPointerException when the trim() is attempted.
String address = request.getParameter("address"); address = address.trim(); String updateString = "UPDATE shippingInfo SET address='?' WHERE email='cwe@example.com'"; emailAddress = con.prepareStatement(updateString); emailAddress.setString(1, address);

Real-world examples:
  - CVE-2000-1003: Client crash when server returns unknown driver type.
CWE-233: Improper Handling of Parameters

Description:
The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-228

Consequences:
  - Integrity: Unexpected State

Detection methods:
  - Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with rand
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
This Android application has registered to handle a URL when sent an intent:
The application assumes the URL will always be included in the intent. When the URL is not present, the call to getStringExtra() will return null, thus causing a null pointer exception when length() is called.
... 
                      IntentFilter filter = new IntentFilter("com.example.URLHandler.openURL"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); 
                      ... 
                      
                      public class UrlHandlerReceiver extends BroadcastReceiver { 
                         @Override public void onReceive(Context context, Intent intent) { 
                               if("com.example.URLHandler.openURL".equals(intent.getAction())) { String URL =
CWE-234: Failure to Handle Missing Parameter

Description:
If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-233

Consequences:
  - Integrity: Execute Unauthorized Code or Commands
  - Availability: DoS: Crash, Exit, or Restart

Mitigations:
  - [Build and Compilation] This issue can be simply combated with the use of proper build process.
  - [Implementation] Forward declare all functions. This is the recommended solution. Properly forward declaration of all used functions will result in a compiler error if too few arguments are sent to a function.

Demonstrative examples:
The following example demonstrates the weakness.
This can be exploited to disclose information with no work whatsoever. In fact, each time this function is run, it will print out the next 4 bytes on the stack after the two numbers sent to it.
foo_funct(one, two); 
                      void foo_funct(int one, int two, int three) { printf("1) %d\n2) %d\n3) %d\n", one, two, three); }
void some_function(int foo, ...) { int a[3], i; va_list ap; va_start(ap, foo); for (i = 0; i < sizeof(a) / sizeof(int); i++) a[i] = va_arg(ap, int); va_end(ap); } 
                      int main(int argc, char *argv[]) { some_function(17, 42); }

Real-world examples:
  - CVE-2004-0276: Server earlier allows remote attackers to cause a denial of service (crash) via an HTTP request with a sequence of "%" characters and a missing Host field.
  - CVE-2002-1488: Chat client allows remote malicious IRC servers to cause a denial of service (crash) via a PART message with (1) a missing channel or (2) a channel that the user is not in.
  - CVE-2002-1169: Proxy allows remote attackers to cause a denial of service (crash) via an HTTP request to helpout.exe with a missing HTTP version numbers.
  - CVE-2000-0521: Web server allows disclosure of CGI source code via an HTTP request without the version number.
  - CVE-2001-0590: Application server allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification.
CWE-235: Improper Handling of Extra Parameters

Description:
The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-233

Consequences:
  - Integrity: Unexpected State

Real-world examples:
  - CVE-2003-1014: MIE. multiple gateway/security products allow restriction bypass using multiple MIME fields with the same name, which are interpreted differently by clients.
CWE-236: Improper Handling of Undefined Parameters

Description:
The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-233

Consequences:
  - Integrity: Unexpected State

Real-world examples:
  - CVE-2002-1488: Crash in IRC client via PART message from a channel the user is not in.
  - CVE-2001-0650: Router crash or bad route modification using BGP updates with invalid transitive attribute.
CWE-237: Improper Handling of Structural Elements

Description:
The product does not handle or incorrectly handles inputs that are related to complex structures.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-228

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.
However, the message length variable (msgLength) from the structure is used as the condition for ending the for loop without validating that msgLength accurately reflects the actual length of the message body (CWE-606). If msgLength indicates a length that is longer than the size of a message body (CWE-130), then this can result in a buffer over-read by reading past the end of the buffer (CWE-126).
int processMessageFromSocket(i
CWE-238: Improper Handling of Incomplete Structural Elements

Description:
The product does not handle or incorrectly handles when a particular structural element is not completely specified.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-237

Consequences:
  - Integrity: Unexpected State
CWE-239: Failure to Handle Incomplete Element

Description:
The product does not properly handle when a particular element is not completely specified.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-237

Consequences:
  - Integrity: Varies by Context

Real-world examples:
  - CVE-2002-1532: HTTP GET without \r\n\r\n CRLF sequences causes product to wait indefinitely and prevents other users from accessing it.
  - CVE-2003-0195: Partial request is not timed out.
  - CVE-2005-2526: MFV. CPU exhaustion in printer via partial printing request then early termination of connection.
  - CVE-2002-1906: CPU consumption by sending incomplete HTTP requests and leaving the connections open.