deardaniel/secdata-raw huggingface dataset:
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable

Description:
The product uses an environment variable to store unencrypted sensitive information.

Extended Description:
Information stored in an environment variable can be accessible by other processes with the execution context, including child processes that dependencies are executed in, or serverless functions in cloud environments. An environment variable's contents can also be inserted into messages, headers, log files, or other outputs. Often these other dependencies have no need to use the environment variable in question. A weakness that discloses environment variables could expose this information.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-312

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Encrypt information stored in the environment variable to protect it from being exposed to an unauthorized user. If encryption is not feasible or is considered too expensive for the business use of the application, then consider using a properly protected configuration file instead of an environment
  - [Implementation] If the environment variable is not necessary for the desired behavior, then remove it entirely, or clear it to an empty value.

Real-world examples:
  - CVE-2022-43691: CMS shows sensitive server-side information from environment variables when run in Debug mode.
  - CVE-2022-27195: Plugin for an automation server inserts environment variable contents into build XML files.
  - CVE-2022-25264: CI/CD tool logs environment variables related to passwords add Contribution to content history.
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere

Description:
The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.

Extended Description:
Version control repositories such as CVS or git store version-specific metadata and other details within subdirectories. If these subdirectories are stored on a web server or added to an archive, then these could be used by an attacker. This information may include usernames, filenames, path root, IP addresses, and detailed "diff" data about how files have been changed - which could reveal source code snippets that were never intended to be made public.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based
Parent weaknesses: CWE-552

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Operation] Recommendations include removing any CVS directories and repositories from the production server, disabling the use of remote CVS repositories, and ensuring that the latest CVS patches and version updates have been performed.
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere

Description:
The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-552

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [System Configuration] Protect the core dump files from unauthorized access.

Real-world examples:
  - CVE-2024-10403: SAN firmware OS includes SFTP/FTP server password in a core dump
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere

Description:
The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere.

Extended Description:
Exposure of these access control list files may give the attacker information about the configuration of the site or system. This information may then be used to bypass the intended security policy or identify trusted systems from which an attack can be launched.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-552

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [System Configuration] Protect access control list files.
CWE-53: Path Equivalence: '\multiple\\internal\backslash'

Description:
The product accepts path input in the form of multiple internal backslash ('\multiple\trailing\\slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-41, CWE-165

Consequences:
  - Confidentiality: Read Files or Directories

Mitigations:
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere

Description:
A backup file is stored in a directory or archive that is made accessible to unauthorized actors.

Extended Description:
Often, older backup files are renamed with an extension such as .~bk to distinguish them from production files. The source code for old files that have been renamed in this manner and left in the webroot can often be retrieved. This renaming may have been performed automatically by the web server, or manually by the administrator.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Server
Parent weaknesses: CWE-552

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Policy] Recommendations include implementing a security policy within your organization that prohibits backing up web application source code in the webroot.

Real-world examples:
  - CVE-2024-7315: Chain: WordPress plugin does not use sufficient randomness when generating the filename for a backup (CWE-340), allowing attackers to obtain backup files (CWE-530)
CWE-531: Inclusion of Sensitive Information in Test Code

Description:
Accessible test applications can pose a variety of security risks. Since developers or administrators rarely consider that someone besides themselves would even know about the existence of these applications, it is common for them to contain sensitive information or functions.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-540

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Distribution] Remove test code before deploying the application into production.

Demonstrative examples:
Examples of common issues with test applications include administrative functions, listings of usernames, passwords or session identifiers and information about the system, server or application configuration.
CWE-532: Insertion of Sensitive Information into Log File

Description:
The product writes sensitive information to a log file.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-538, CWE-200

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
  - [Distribution] Remove debug log files before deploying the application into production.
  - [Operation] Protect log files against unauthorized read/write.
  - [Implementation] Adjust configurations appropriately when software is transitioned from a debug state to production.

Demonstrative examples:
In the following code snippet, a user's full name and credit card number are written to a log file.

logger.info("Username: " + usernme + ", CCN: " + ccn);

This code stores location information about the current user:
When the application encounters an exception it will write the user object to the log. Because the user object contains location information, the user's location is also written to the log.
locationClient = new LocationClient(this, this, this); locationClient.connect(); currentUser.setLocation(locationClient.getLastLocation()); 
                      ... 
                      
                      catch (Exception e) { AlertDialog.Builder builder = new AlertDialog.Builder(this); builder.setMessage("Sorry, this application has experienced an error."); AlertDialog alert = builder.create(); alert.show(); Log.e("ExampleActivity", "Caught exception: " + e + " While on User:" + User.toString()); }

Real-world examples:
  - CVE-2017-9615: verbose logging stores admin credentials in a world-readable log file
  - CVE-2[PII_REDACTED]: SSH password for private key stored in build log
CWE-535: Exposure of Information Through Shell Error Message

Description:
A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-211

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-536: Servlet Runtime Error Message Containing Sensitive Information

Description:
A servlet error message indicates that there exists an unhandled exception in the web application code and may provide useful information to an attacker.

Affected languages: Java
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-211

Consequences:
  - Confidentiality: Read Application Data

Demonstrative examples:
The following servlet code does not catch runtime exceptions, meaning that if such an exception were to occur, the container may display potentially dangerous information (such as a full stack trace).

public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { 
                         String username = request.getParameter("username"); 
                            
                            // May cause unchecked NullPointerException. 
                            if (username.length() < 10) { ... } 
                      }
CWE-537: Java Runtime Error Message Containing Sensitive Information

Description:
In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.

Affected languages: Java
Parent weaknesses: CWE-211

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Implementation] Do not expose sensitive error information to the user.

Demonstrative examples:
In the following Java example the class InputFileRead enables an input file to be read using a FileReader object. In the constructor of this class a default input file path is set to some directory on the local file system and the method setInputFile must be called to set the name of the input file to be read in the default directory. The method readInputFile will create the FileReader object and will read the contents of the file. If the method setInputFile is not called prior to calling the method readInputFile then the File object will remain null when initializing the FileReader object. A Java RuntimeException will be raised, and an error message will be output to the user.
However, the error message output to the user contains information regarding the default directory on the local f

In the example below, the BankManagerLoginServlet servlet class will process a login request to determine if a user is authorized to use the BankManager Web service. The doPost method will retrieve the username and password from the servlet request and will determine if the user is authorized. If the user is authorized the servlet will go to the successful login page. Otherwise, the servlet will raise a FailedLoginException and output the failed login message to the error page of the service.
However, the output message generated by the FailedLoginException includes the user-supplied password. Even if the password is erroneous, it is probably close to the correct password. Since it is printed to the user's page, anybody who can see the screen display will be able to see the password. Also,
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory

Description:
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-200

Consequences:
  - Confidentiality: Read Files or Directories

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Do not expose file and directory information to the user.

Demonstrative examples:
In the following code snippet, a user's full name and credit card number are written to a log file.

logger.info("Username: " + usernme + ", CCN: " + ccn);

Real-world examples:
  - CVE-2[PII_REDACTED]: SSH password for private key stored in build log
CWE-539: Use of Persistent Cookies Containing Sensitive Information

Description:
The web application uses persistent cookies, but the cookies contain sensitive information.

Extended Description:
Cookies are small bits of data that are sent by the web application but stored locally in the browser. This lets the application use the cookie to pass information between pages and store variable information. The web application controls what information is stored in a cookie and how it is used. Typical types of information stored in cookies are session identifiers, personalization and customization information, and in rare cases even usernames to enable automated logins. There are two different types of cookies: session cookies and persistent cookies. Session cookies just live in the browser's memory and are not stored anywhere, but persistent cookies are stored on the browser's hard drive.   This can cause security and privacy issues depending on the information stored in the cookie and how it is accessed.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-552

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Do not store sensitive information in persistent cookies.
CWE-54: Path Equivalence: 'filedir\' (Trailing Backslash)

Description:
The product accepts path input in the form of trailing backslash ('filedir\') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-41, CWE-162

Consequences:
  - Confidentiality: Read Files or Directories

Mitigations:
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i

Real-world examples:
  - CVE-2004-0847: web framework for .NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash)
  - CVE-2004-0061: Bypass directory access restrictions using trailing dot in URL
CWE-540: Inclusion of Sensitive Information in Source Code

Description:
Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.

Extended Description:
There are situations where it is critical to remove source code from an area or server. For example, obtaining Perl source code on a system allows an attacker to understand the logic of the script and extract extremely useful information such as code bugs or logins and passwords.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based
Parent weaknesses: CWE-538

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Recommendations include removing this script from the web server and moving it to a location not accessible from the Internet.

Demonstrative examples:
The following code uses an include file to store database credentials:
database.inc
<?php $dbName = 'usersDB'; $db[CREDENTIAL_REDACTED]'; ?>
<?php include('database.inc'); $db = connectToDB($dbName, $dbPassword); $db.authenticateUser($username, $password); ?>

The following comment, embedded in a JSP, will be displayed in the resulting HTML output.

<!-- FIXME: calling this with more than 30 args kills the JDBC server -->

Real-world examples:
  - CVE-2022-25512: Server for Team Awareness Kit (TAK) application includes sensitive tokens in the JavaScript source code.
  - CVE-2022-24867: The LDAP password might be visible in the html code of a rendered page in an IT Asset Management tool.
  - CVE-2007-6197: Version numbers and internal hostnames leaked in HTML comments.
CWE-541: Inclusion of Sensitive Information in an Include File

Description:
If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-540

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Architecture and Design] Do not store sensitive information in include files.
  - [Architecture and Design] Protect include files from being exposed.

Demonstrative examples:
The following code uses an include file to store database credentials:
database.inc
<?php $dbName = 'usersDB'; $db[CREDENTIAL_REDACTED]'; ?>
<?php include('database.inc'); $db = connectToDB($dbName, $dbPassword); $db.authenticateUser($username, $password); ?>
CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context

Description:
The product uses the singleton pattern when creating a resource within a multithreaded environment.

Extended Description:
The use of a singleton pattern may not be thread-safe.

Affected languages: Java, C++
Parent weaknesses: CWE-820, CWE-662, CWE-662

Consequences:
  - Other: Other

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Use the Thread-Specific Storage Pattern. See References.
  - [Implementation] Do not use member fields to store information in the Servlet. In multithreading environments, storing user data in Servlet member fields introduces a data access race condition.
  - [Implementation] Avoid using the double-checked locking pattern in language versions that cannot guarantee thread safety. This pattern may be used to avoid the overhead of a synchronized call, but in certain versions of Java (for example), this has been shown to be unsafe because it still introduces a race condition

Demonstrative examples:
This method is part of a singleton pattern, yet the following singleton() pattern is not thread-safe. It is possible that the method will create two objects instead of only one.
Consider the following course of events:
private static NumberConverter singleton; public static NumberConverter get_singleton() { if (singleton == null) { singleton = new NumberConverter(); } return singleton; }
CWE-544: Missing Standardized Error Handling Mechanism

Description:
The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.

Extended Description:
If the product handles error messages individually, on a one-by-one basis, this is likely to result in inconsistent error handling. The causes of errors may be lost. Also, detailed information about the causes of an error may be unintentionally returned to the user.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-755

Consequences:
  - Integrity: Quality Degradation

Mitigations:
  - [Architecture and Design] define a strategy for handling errors of different severities, such as fatal errors versus basic log events. Use or create built-in language features, or an external package, that provides an easy-to-use API and define coding standards for the detection and handling of errors.
CWE-546: Suspicious Comment

Description:
The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.

Extended Description:
Many suspicious comments, such as BUG, HACK, FIXME, LATER, LATER2, TODO, in the code indicate missing security functionality and checking. Others indicate code problems that programmers should fix, such as hard-coded variables, error handling, not using stored procedures, and performance issues.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1078

Consequences:
  - Other: Quality Degradation

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Documentation] Remove comments that suggest the presence of bugs, incomplete functionality, or weaknesses, before deploying the application.

Demonstrative examples:
The following excerpt demonstrates the use of a suspicious comment in an incomplete code block that may have security repercussions.

if (user == null) { 
                         
                            
                            // TODO: Handle null user condition. 
                            
                         
                      }