deardaniel/secdata-raw huggingface dataset:
CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Description:
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-664

Consequences:
  - Confidentiality: Read Application Data
  - Access Control: Gain Privileges or Assume Identity

Demonstrative examples:
The following code is a Java servlet that will receive a GET request with a url parameter in the request to redirect the browser to the address specified in the url parameter. The servlet will retrieve the url parameter value from the request and send a response to redirect the browser to the url address.
The problem with this Java servlet code is that an attacker could use the RedirectServlet as part of an e-mail phishing scam to redirect users to a malicious site. An attacker could send an HTML formatted e-mail directing the user to log into their account by including in the e-mail the following link:
public class RedirectServlet extends HttpServlet { 
                
                  protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException

Real-world examples:
  - CVE-2022-3032: An email client does not block loading of remote objects in a nested document.
  - CVE-2022-45918: Chain: a learning management tool debugger uses external input to locate previous session logs (CWE-73) and does not properly validate the given path (CWE-20), allowing for filesystem path traversal u
  - CVE-2[PII_REDACTED]: Cryptography API uses unsafe reflection when deserializing a private key
  - CVE-2020-11053: Chain: Go-based Oauth2 reverse proxy can send the authenticated user to another site at the end of the authentication flow. A redirect URL with HTML-encoded whitespace characters can bypass the valida
  - CVE-2022-42745: Recruiter software allows reading arbitrary files using XXE
CWE-611: Improper Restriction of XML External Entity Reference

Description:
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Affected languages: Not Language-Specific, XML
Affected technologies: Not Technology-Specific, Web Based
Parent weaknesses: CWE-610, CWE-610

Consequences:
  - Confidentiality: Read Application Data
  - Integrity: Bypass Protection Mechanism
  - Availability: DoS: Resource Consumption (CPU)

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Many XML parsers and validators can be configured to disable external entity expansion.

Real-world examples:
  - CVE-2022-42745: Recruiter software allows reading arbitrary files using XXE
  - CVE-2005-1306: A browser control can allow remote attackers to determine the existence of files via Javascript containing XML script.
  - CVE-2012-5656: XXE during SVG image conversion
  - CVE-2012-2239: XXE in PHP application allows reading the application's configuration file.
  - CVE-2012-3489: XXE in database server
CWE-612: Improper Authorization of Index Containing Sensitive Information

Description:
The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.

Extended Description:
Web sites and other document repositories may apply an indexing routine against a group of private documents to facilitate search.  If the index's results are available to parties who do not have access to the documents being indexed, then attackers could obtain portions of the documents by conducting targeted searches and reading the results.  The risk is especially dangerous if search results include surrounding text that was not part of the search query. This issue can appear in search engines that are not configured (or implemented) to ignore critical files that should remain hidden; even without permissions to download these files directly, the remote user could read them.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based, Web Server
Parent weaknesses: CWE-1230

Consequences:
  - Confidentiality: Read Application Data

Real-world examples:
  - CVE-2022-41918: A search application's access control rules are not properly applied to indices for data streams, allowing for the viewing of sensitive information.
CWE-613: Insufficient Session Expiration

Description:
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-672, CWE-672

Consequences:
  - Access Control: Bypass Protection Mechanism

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Set sessions/credentials expiration date.

Demonstrative examples:
The following snippet was taken from a J2EE web.xml deployment descriptor in which the session-timeout parameter is explicitly defined (the default value depends on the container). In this case the value is set to -1, which means that a session will never expire.

<web-app> 
                         [...snipped...] 
                            <session-config> <session-timeout>-1</session-timeout> </session-config> 
                      </web-app>

Real-world examples:
  - CVE-2025-46344: JavaScript SDK does not set an expiration time for JWE tokens related to a session
  - CVE-2024-8888: Web interface for a power quality analyzer uses tokens without an expiration date
  - CVE-2024-35206: network traffic analyzer for PROFINET networks does not expire sessions
  - CVE-2024-27782: AI/ML monitor for IT operations allows re-use of old session tokens due to insufficient session expiration
CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Description:
The Secure attribute for sensitive cookies in HTTPS sessions is not set.
Affected technologies: Web Based
Parent weaknesses: CWE-319

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Always set the secure attribute when the cookie should be sent via HTTPS only.

Demonstrative examples:
The snippet of code below, taken from a servlet doPost() method, sets an accountID cookie (sensitive) without calling setSecure(true).

Cookie c = new Cookie(ACCOUNT_ID, acctID); response.addCookie(c);

Real-world examples:
  - CVE-2024-47833: python library for ML and data science does not use the Secure flag for session cookies
  - CVE-2004-0462: A product does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the product.
  - CVE-2008-3663: A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie
  - CVE-2008-3662: A product does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie
  - CVE-2008-0128: A product does not set the secure flag for a cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CWE-615: Inclusion of Sensitive Information in Source Code Comments

Description:
While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.

Extended Description:
An attacker who finds these comments can map the application's structure and files, expose hidden parts of the site, and study the fragments of code to reverse engineer the application, which may help develop further attacks against the site.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-540

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Distribution] Remove comments which have sensitive information about the design/implementation of the application. Some of the comments may be exposed to the user and affect the security posture of the application.

Demonstrative examples:
The following comment, embedded in a JSP, will be displayed in the resulting HTML output.

<!-- FIXME: calling this with more than 30 args kills the JDBC server -->

Real-world examples:
  - CVE-2007-6197: Version numbers and internal hostnames leaked in HTML comments.
  - CVE-2007-4072: CMS places full pathname of server in HTML comment.
  - CVE-2009-2431: blog software leaks real username in HTML comment.
CWE-616: Incomplete Identification of Uploaded File Variables (PHP)

Description:
The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.

Extended Description:
These global variables could be overwritten by POST requests, cookies, or other methods of populating or overwriting these variables. This could be used to read or process arbitrary files by providing values such as "/etc/passwd".

Affected languages: PHP
Parent weaknesses: CWE-345

Consequences:
  - Confidentiality: Read Files or Directories

Mitigations:
  - [Architecture and Design] Use PHP 4 or later.
  - [Architecture and Design] If you must support older PHP versions, write your own version of is_uploaded_file() and run it against $HTTP_POST_FILES['userfile']))
  - [Implementation] For later PHP versions, reference uploaded files using the $HTTP_POST_FILES or $_FILES variables, and use is_uploaded_file() or move_uploaded_file() to ensure that you are dealing with an uploaded file.

Demonstrative examples:
As of 2006, the "four globals" method is probably in sharp decline, but older PHP applications could have this issue.
In the "four globals" method, PHP sets the following 4 global variables (where "varname" is application-dependent):
$varname = name of the temporary file on local machine $varname_size = size of file $varname_name = original name of file provided by client $varname_type = MIME type of the file

"The global $_FILES exists as of PHP 4.1.0 (Use $HTTP_POST_FILES instead if using an earlier version). These arrays will contain all the uploaded file information."
** note: 'userfile' is the field name from the web form; this can vary.
$_FILES['userfile']['name'] - original filename from client $_FILES['userfile']['tmp_name'] - the temp filename of the file on the server

Real-world examples:
  - CVE-2002-1460: Forum does not properly verify whether a file was uploaded or if the associated variables were set by POST, allowing remote attackers to read arbitrary files.
  - CVE-2002-1759: Product doesn't check if the variables for an upload were set by uploading the file, or other methods such as $_POST.
  - CVE-2002-1710: Product does not distinguish uploaded file from other files.
CWE-617: Reachable Assertion

Description:
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Extended Description:
While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service. 
             For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.

Affected languages: Not Language-Specific, C, Java, Rust
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-705, CWE-670

Consequences:
  - Availability: DoS: Crash, Exit, or Restart

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
  - [Implementation] Perform input validation on user data.

Demonstrative examples:
In the excerpt below, an AssertionError (an unchecked exception) is thrown if the user hasn't entered an email address in an HTML form.

String email = request.getParameter("email_address"); assert email != null;

Real-world examples:
  - CVE-2024-8768: API server for LLM library can crash when provided an empty prompt, which triggers a reachable  assertion
  - CVE-2023-49286: Chain: function in web caching proxy does not correctly check a return value (CWE-253) leading to a reachable assertion (CWE-617)
  - CVE-2006-6767: FTP server allows remote attackers to cause a denial of service (daemon abort) via crafted commands which trigger an assertion failure.
  - CVE-2006-6811: Chat client allows remote attackers to cause a denial of service (crash) via a long message string when connecting to a server, which causes an assertion failure.
  - CVE-2006-5779: Product allows remote attackers to cause a denial of service (daemon crash) via LDAP BIND requests with long authcid names, which triggers an assertion failure.
CWE-618: Exposed Unsafe ActiveX Method

Description:
An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain).

Extended Description:
ActiveX controls can exercise far greater control over the operating system than typical Java or javascript. Exposed methods can be subject to various vulnerabilities, depending on the implemented behaviors of those methods, and whether input validation is performed on the provided arguments. If there is no integrity checking or origin validation, this method could be invoked by attackers.

Affected languages: Not Language-Specific
Affected technologies: Web Based
Parent weaknesses: CWE-749

Consequences:
  - Other: Other

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] If you must expose a method, make sure to perform input validation on all arguments, and protect against all possible vulnerabilities.
  - [Architecture and Design] Use code signing, although this does not protect against any weaknesses that are already in the control.
  - [Architecture and Design] Where possible, avoid marking the control as safe for scripting.

Real-world examples:
  - CVE-2007-1120: download a file to arbitrary folders.
  - CVE-2006-6838: control downloads and executes a url in a parameter
  - CVE-2007-0321: resultant buffer overflow
CWE-619: Dangling Database Cursor ('Cursor Injection')

Description:
If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor "dangling."

Extended Description:
For example, an improper dangling cursor could arise from unhandled exceptions. The impact of the issue depends on the cursor's role, but SQL injection attacks are commonly possible.

Affected languages: SQL
Affected technologies: Database Server
Parent weaknesses: CWE-402

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Implementation] Close cursors immediately after access to them is complete. Ensure that you close cursors if exceptions occur.
CWE-62: UNIX Hard Link

Description:
The product, when opening a file or directory, does not sufficiently account for when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Extended Description:
Failure for a system to check for hard links can result in vulnerability to different types of attacks. For example, an attacker can escalate their privileges if a file used by a privileged program is replaced with a hard link to a sensitive file (e.g. /etc/passwd). When the process opens the file, the attacker can assume the privileges of that process.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-59

Consequences:
  - Confidentiality: Read Files or Directories

Mitigations:
  - [Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system. 
                   Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected ar

Real-world examples:
  - CVE-2001-1494: Hard link attack, file overwrite; interesting because program checks against soft links
  - CVE-2002-0793: Hard link and possibly symbolic link following vulnerabilities in embedded operating system allow local users to overwrite arbitrary files.
  - CVE-2003-0578: Server creates hard links and unlinks files as root, which allows local users to gain privileges by deleting and overwriting arbitrary files.
  - CVE-1999-0783: Operating system allows local users to conduct a denial of service by creating a hard link from a device special file to a file on an NFS file system.
  - CVE-2004-1603: Web hosting manager follows hard links, which allows local users to read or modify arbitrary files.
CWE-620: Unverified Password Change

Description:
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Extended Description:
This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-1390

Consequences:
  - Access Control: Bypass Protection Mechanism

Mitigations:
  - [Architecture and Design] When prompting for a password change, force the user to provide the original password in addition to the new password.
  - [Architecture and Design] Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity informa

Demonstrative examples:
This code changes a user's password.
While the code confirms that the requesting user typed the same new password twice, it does not confirm that the user requesting the password change is the same user whose password will be changed. An attacker can request a change of another user's password and gain control of the victim's account.
$user = $_GET['user']; $pass = $_GET['pass']; $checkpass = $_GET['checkpass']; if ($pass == $checkpass) { SetUserPassword($user, $pass); }

Real-world examples:
  - CVE-2025-4903: Router web interface allows unverified password change
  - CVE-2007-0681: Web app allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions.
  - CVE-2000-0944: Web application password change utility doesn't check the original password.
CWE-621: Variable Extraction Error

Description:
The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables.

Extended Description:
For example, in PHP, extraction can be used to provide functionality similar to register_globals, a dangerous functionality that is frequently disabled in production systems. Calling extract() or import_request_variables() without the proper arguments could allow arbitrary global variables to be overwritten, including superglobals. 
             Similar functionality is possible in other interpreted languages, including custom languages.

Affected languages: PHP
Parent weaknesses: CWE-914

Consequences:
  - Integrity: Modify Application Data

Mitigations:
  - [Implementation] Use allowlists of variable names that can be extracted.
  - [Implementation] Consider refactoring your code to avoid extraction routines altogether.
  - [Implementation] In PHP, call extract() with options such as EXTR_SKIP and EXTR_PREFIX_ALL; call import_request_variables() with a prefix argument. Note that these capabilities are not present in all PHP versions.

Demonstrative examples:
This code uses the credentials sent in a POST request to login a user.
The call to extract() will overwrite the existing values of any variables defined previously, in this case $isAdmin. An attacker can send a POST request with an unexpected third value "isAdmin" equal to "true", thus gaining Admin privileges.
//Log user in, and set $isAdmin to true if user is an administrator 
                      
                      function login($user,$pass){ $query = buildQuery($user,$pass); mysql_query($query); if(getUserRole($user) == "Admin"){ $isAdmin = true; } } 
                      $isAdmin = false; extract($_POST); login(mysql_real_escape_string($user),mysql_real_escape_string($pass));

Real-world examples:
  - CVE-2006-7135: extract issue enables file inclusion
  - CVE-2006-7079: Chain: PHP app uses extract for register_globals compatibility layer (CWE-621), enabling path traversal (CWE-22)
  - CVE-2007-0649: extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect.
  - CVE-2006-6661: extract() enables static code injection
  - CVE-2006-2828: import_request_variables() buried in include files makes post-disclosure analysis confusing