deardaniel/secdata-raw huggingface dataset:
CWE-687: Function Call With Incorrectly Specified Argument Value

Description:
The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-628

Consequences:
  - Other: Quality Degradation

Detection methods:
  - Manual Static Analysis: This might require an understanding of intended program behavior or design to determine whether the value is incorrect.

Demonstrative examples:
This Perl code intends to record whether a user authenticated successfully or not, and to exit if the user fails to authenticate. However, when it calls ReportAuth(), the third argument is specified as 0 instead of 1, so it does not exit.

sub ReportAuth { my ($username, $result, $fatal) = @_; PrintLog("auth: username=%s, result=%d", $username, $result); if (($result ne "success") && $fatal) { die "Failed!\n"; } } 
                      sub PrivilegedFunc { my $result = CheckAuth($username); ReportAuth($username, $result, 0); DoReallyImportantStuff(); }
CWE-688: Function Call With Incorrect Variable or Reference as Argument

Description:
The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.

Affected languages: C, Perl
Parent weaknesses: CWE-628

Consequences:
  - Other: Quality Degradation

Detection methods:
  - Other: While this weakness might be caught by the compiler in some languages, it can occur more frequently in cases in which the called function accepts variable numbers of arguments, such as format strings 

Mitigations:
  - [Testing] Because this function call often produces incorrect behavior it will usually be detected during testing or normal operation of the product. During testing exercise all possible control paths will typically expose this weakness except in rare cases when the incorrect function call accidentally produc

Demonstrative examples:
In the following Java snippet, the accessGranted() method is accidentally called with the static ADMIN_ROLES array rather than the user roles.

private static final String[] ADMIN_ROLES = ...; public boolean void accessGranted(String resource, String user) { String[] userRoles = getUserRoles(user); return accessGranted(resource, ADMIN_ROLES); } 
                      private boolean void accessGranted(String resource, String[] userRoles) { 
                         
                            
                            // grant or deny access based on user roles 
                            ... 
                      }

Real-world examples:
  - CVE-2005-2548: Kernel code specifies the wrong variable in first argument, leading to resultant NULL pointer dereference.
CWE-689: Permission Race Condition During Resource Copy

Description:
The product, while copying or cloning a resource, does not set the resource's permissions or access control until the copy is complete, leaving the resource exposed to other spheres while the copy is taking place.

Affected languages: C, Perl
Parent weaknesses: CWE-362

Consequences:
  - Confidentiality: Read Application Data

Real-world examples:
  - CVE-2002-0760: Archive extractor decompresses files with world-readable permissions, then later sets permissions to what the archive specified.
  - CVE-2005-2174: Product inserts a new object into database before setting the object's permissions, introducing a race condition.
  - CVE-2006-5214: Error file has weak permissions before a chmod is performed.
  - CVE-2005-2475: Archive permissions issue using hard link.
  - CVE-2003-0265: Database product creates files world-writable before initializing the setuid bits, leading to modification of executables.
CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream

Description:
The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

Extended Description:
An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-66

Consequences:
  - Access Control: Bypass Protection Mechanism

Detection methods:
  - Automated Analysis: Software tools are capable of finding ADSs on your system.

Mitigations:
  - [Implementation] Ensure that the source code correctly parses the filename to read or write to the correct stream.

Real-world examples:
  - CVE-1999-0278: In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.
  - CVE-2000-0927: Product does not properly record file sizes if they are stored in alternative data streams, which allows users to bypass quota restrictions.
CWE-690: Unchecked Return Value to NULL Pointer Dereference

Description:
The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.

Extended Description:
While unchecked return value weaknesses are not limited to returns of NULL pointers (see the examples in CWE-252), functions often return NULL to indicate an error status. When this error condition is not checked, a NULL pointer dereference can occur.

Affected languages: Memory-Unsafe, C, C++
Parent weaknesses: CWE-252

Consequences:
  - Availability: DoS: Crash, Exit, or Restart
  - Integrity: Execute Unauthorized Code or Commands

Detection methods:
  - Black Box: This typically occurs in rarely-triggered error conditions, reducing the chances of detection during black box testing.
  - White Box: Code analysis can require knowledge of API behaviors for library functions that might return NULL, reducing the chances of detection when unknown libraries are used.
  - Automated Dynamic Analysis: Use tools that are integrated during
	      compilation to insert runtime error-checking mechanisms
	      related to memory safety errors, such as AddressSanitizer
	      (ASan) for C/C++ [REF-1518].

Demonstrative examples:
The code below makes a call to the getUserName() function but doesn't check the return value before dereferencing (which may cause a NullPointerException).

String username = getUserName(); if (username.equals(ADMIN_USER)) { ... }

This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.
If an attacker provides an address that appears to be well-formed, but the address does not resolve to a hostname, then the call to gethostbyaddr() will return NULL. Since the code does not check the return value from gethostbyaddr (CWE-252), a NULL pointer dereference (CWE-476) would then occur in the call to strcpy().
void host_lookup(char *user_supplied_addr){ 
                         struct hostent *hp; in_addr_t *addr; char hostname[64]; in_addr_t inet_addr(const char *cp); 
                            
                            /*routine that ensures user_supplied_addr is in the right format for conversion */ 
                            
      

Real-world examples:
  - CVE-2008-1052: Large Content-Length value leads to NULL pointer dereference when malloc fails.
  - CVE-2006-6227: Large message length field leads to NULL pointer dereference when malloc fails.
  - CVE-2006-2555: Parsing routine encounters NULL dereference when input is missing a colon separator.
  - CVE-2003-1054: URI parsing API sets argument to NULL when a parsing failure occurs, such as when the Referer header is missing a hostname, leading to NULL dereference.
  - CVE-2008-5183: chain: unchecked return value can lead to NULL dereference
CWE-691: Insufficient Control Flow Management

Description:
The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific

Consequences:
  - Other: Alter Execution Logic

Demonstrative examples:
The following function attempts to acquire a lock in order to perform operations on a shared resource.
However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior.
void f(pthread_mutex_t *mutex) { 
                         pthread_mutex_lock(mutex); 
                            
                            /* access shared resource */ 
                            
                            
                            pthread_mutex_unlock(mutex); 
                      }
int f(pthread_mutex_t *mutex) { 
                         int result; 
                            result = pthread_mutex_lock(mutex); 

In this example, the programmer has indented the statements to call Do_X() and Do_Y(), as if the intention is that these functions are only called when the condition is true. However, because there are no braces to signify the block, Do_Y() will always be executed, even if the condition is false.
This might not be what the programmer intended. When the condition is critical for security, such as in making a security decision or detecting a critical error, this may produce a vulnerability.
if (condition==true) Do_X(); Do_Y();

Real-world examples:
  - CVE-2024-50653: e-commerce product does not restrict the number of requests for coupons
  - CVE-2019-9805: Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption.
  - CVE-2014-1266: Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-56
  - CVE-2011-1027: Chain: off-by-one error (CWE-193) leads to infinite loop (CWE-835) using invalid hex-encoded characters.
CWE-692: Incomplete Denylist to Cross-Site Scripting

Description:
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

Extended Description:
While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-184

Consequences:
  - Confidentiality: Execute Unauthorized Code or Commands

Real-world examples:
  - CVE-2007-5727: Denylist only removes <SCRIPT> tag.
  - CVE-2006-3617: Denylist only removes <SCRIPT> tag.
  - CVE-2006-4308: Denylist only checks "javascript:" tag
CWE-693: Protection Mechanism Failure

Description:
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Extended Description:
This weakness covers three distinct situations. A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack. An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended. Finally, an "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, ICS/OT

Consequences:
  - Access Control: Bypass Protection Mechanism
CWE-694: Use of Multiple Resources with Duplicate Identifier

Description:
The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

Extended Description:
If the product assumes that each resource has a unique identifier, the product could operate on the wrong resource if attackers can cause multiple resources to be associated with the same identifier.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-99, CWE-573

Consequences:
  - Access Control: Bypass Protection Mechanism
  - Other: Quality Degradation

Mitigations:
  - [Architecture and Design] Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.

Demonstrative examples:
These two Struts validation forms have the same name.
It is not certain which form will be used by Struts. It is critically important that validation logic be maintained and kept in sync with the rest of the product.
<form-validation>
				    
					 <formset>
					  
					   <form name="ProjectForm"> ... </form> 
					   <form name="ProjectForm"> ... </form>
					  
					 </formset>
				    
				   </form-validation>

Real-world examples:
  - CVE-2013-4787: chain: mobile OS verifies cryptographic signature of file in an archive, but then installs a different file with the same name that is also listed in the archive.
CWE-695: Use of Low-Level Functionality

Description:
The product uses low-level functionality that is explicitly prohibited by the framework or specification under which the product is supposed to operate.

Extended Description:
The use of low-level functionality can violate the specification in unexpected ways that effectively disable built-in protection mechanisms, introduce exploitable inconsistencies, or otherwise expose the functionality to attack.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-573

Consequences:
  - Other: Other

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
The following code defines a class named Echo. The class declares one native method (defined below), which uses C to echo commands entered on the console back to the user. The following C code defines the native method implemented in the Echo class:
Because the example is implemented in Java, it may appear that it is immune to memory issues like buffer overflow vulnerabilities. Although Java does do a good job of making memory operations safe, this protection does not extend to vulnerabilities occurring in source code written in other languages that are accessed using the Java Native Interface. Despite the memory protections offered in Java, the C code in this example is vulnerable to a buffer overflow because it makes use of gets(), which does not check the length of its input.
class Echo

The following example opens a socket to connect to a remote server.
A Socket object is created directly within the Java servlet, which is a dangerous way to manage remote connections.
public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { 
                         
                            
                            // Perform servlet tasks. 
                            ... 
                            
                            // Open a socket to a remote server (bad). 
                            Socket sock = null; 
                            try { 
                               sock = new Socket(remoteHostname, 3000); 
                                  
                                  // Do something with the socke
CWE-696: Incorrect Behavior Order

Description:
The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based
Parent weaknesses: CWE-691

Consequences:
  - Integrity: Alter Execution Logic

Demonstrative examples:
The following code attempts to validate a given input path by checking it against an allowlist and then return the canonical path. In this specific case, the path is considered valid if it starts with the string "/safe_dir/".
The problem with the above code is that the validation step occurs before canonicalization occurs. An attacker could provide an input path of "/safe_dir/../" that would pass the validation step. However, the canonicalization process sees the double dot as a traversal to the parent directory and hence when canonicized the path would become just "/".
String path = getInputPath(); if (path.startsWith("/safe_dir/")) { File f = new File(path); return f.getCanonicalPath(); }
String path = getInputPath(); File f = new File(path); if (f.getCanonicalPath().startsWith("/safe_di

This function prints the contents of a specified file requested by a user.
This code first reads a specified file into memory, then prints the file if the user is authorized to see its contents. The read of the file into memory may be resource intensive and is unnecessary if the user is not allowed to see the file anyway.
function printFile($username,$filename){ 
                         
                            
                            //read file into string 
                            $file = file_get_contents($filename); if ($file && isOwnerOf($username,$filename)){ echo $file; return true; } else{ echo 'You are not authorized to view this file'; } return false; 
                      }

Real-world examples:
  - CVE-2019-9805: Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption.
  - CVE-2007-5191: file-system management programs call the setuid and setgid functions in the wrong order and do not check the return values, allowing attackers to gain unintended privileges
  - CVE-2007-1588: C++ web server program calls Process::setuid before calling Process::setgid, preventing it from dropping privileges, potentially allowing CGI programs to be called with higher privileges than intended
  - CVE-2022-37734: Chain: lexer in Java-based GraphQL server does not enforce maximum of tokens early enough (CWE-696), allowing excessive CPU consumption (CWE-1176)
CWE-697: Incorrect Comparison

Description:
The product compares two entities in a security-relevant context, but the comparison is incorrect.

Extended Description:
This Pillar covers several possibilities: 
                
                   the comparison checks one factor incorrectly; 
                   the comparison should consider multiple factors, but it does not check at least one of those factors at all; 
                   the comparison checks the wrong factor.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific

Consequences:
  - Other: Varies by Context

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
Consider an application in which Truck objects are defined to be the same if they have the same make, the same model, and were manufactured in the same year.
Here, the equals() method only checks the make and model of the Truck objects, but the year of manufacture is not included.
public class Truck { 
                         private String make; private String model; private int year; 
                            public boolean equals(Object o) { 
                               if (o == null) return false; if (o == this) return true; if (!(o instanceof Truck)) return false; 
                                  Truck t = (Truck) o; 
                                  return (this.make.equals(t.getMake()) && this.model.equals(t.getModel())); 
                            } 
                   

This example defines a fixed username and password. The AuthenticateUser() function is intended to accept a username and a password from an untrusted user, and check to ensure that it matches the username and password. If the username and password match, AuthenticateUser() is intended to indicate that authentication succeeded.
In AuthenticateUser(), the strncmp() call uses the string length of an attacker-provided inPass parameter in order to determine how many characters to check in the password. So, if the attacker only provides a password of length 1, the check will only examine the first byte of the application's password before determining success.
/* Ignore CWE-259 (hard-coded password) and CWE-309 (use of password system for authentication) for this example. */ 
                    

Real-world examples:
  - CVE-2021-3116: Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an  incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of 
  - CVE-2020-15811: Chain: Proxy uses a substring search instead of parsing the Transfer-Encoding header (CWE-697), allowing request splitting (CWE-113) and cache poisoning
  - CVE-2016-10003: Proxy performs incorrect comparison of request headers, leading to infoleak
CWE-698: Execution After Redirect (EAR)

Description:
The web application sends a redirect to another location, but instead of exiting, it executes additional code.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-705, CWE-670

Consequences:
  - Other: Alter Execution Logic

Detection methods:
  - Black Box: This issue might not be detected if testing is performed using a web browser, because the browser might obey the redirect and move the user to a different page before the application has produced outp

Demonstrative examples:
This code queries a server and displays its status when a request comes from an authorized IP address.
This code redirects unauthorized users, but continues to execute code after calling http_redirect(). This means even unauthorized users may be able to access the contents of the page or perform a DoS attack on the server being queried. Also, note that this code is vulnerable to an IP address spoofing attack (CWE-212).
$requestingIP = $_SERVER['REMOTE_ADDR']; if(!in_array($requestingIP,$ipAllowList)){ echo "You are not authorized to view this page"; http_redirect($errorPageURL); } $status = getServerStatus(); echo $status; 
                      ...

Real-world examples:
  - CVE-2013-1402: Execution-after-redirect allows access to application configuration details.
  - CVE-2009-1936: chain: library file sends a redirect if it is directly requested but continues to execute, allowing remote file inclusion and path traversal.
  - CVE-2007-2713: Remote attackers can obtain access to administrator functionality through EAR.
  - CVE-2007-4932: Remote attackers can obtain access to administrator functionality through EAR.
  - CVE-2007-5578: Bypass of authentication step through EAR.