deardaniel/secdata-raw huggingface dataset:
CWE-1077: Floating Point Comparison with Incorrect Operator

Description:
The code performs a comparison such as an
        equality test between two float (floating point) values, but
        it uses comparison operators that do not account for the
        possibility of loss of precision.

Extended Description:
Numeric calculation using floating point values
	   can generate imprecise results because of rounding errors.
	   As a result, two different calculations might generate
	   numbers that are mathematically equal, but have slightly
	   different bit representations that do not translate to the
	   same mathematically-equal values.  As a result, an equality
	   test or other comparison might produce unexpected
	   results.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-697

Consequences:
  - Other: Reduce Reliability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1078: Inappropriate Source Code Style or Formatting

Description:
The source code does not follow
				desired style or formatting for indentation, white
				space, comments, etc.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1076

Consequences:
  - Other: Increase Analytical Complexity

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
  - Automated Static Analysis - Source Code: An Integrated Development Environment (IDE) or linter can report or highlight this weaknesses.

Demonstrative examples:
The usage of symbolic names instead of hard-coded constants is preferred.
The following is an example of using a hard-coded constant instead of a symbolic name.
char buffer[1024]; ... fgets(buffer, 1024, stdin);
enum { MAX_BUFFER_SIZE = 1024 }; ... char buffer[MAX_BUFFER_SIZE]; ... fgets(buffer, MAX_BUFFER_SIZE, stdin);
CWE-1079: Parent Class without Virtual Destructor Method

Description:
A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1076

Consequences:
  - Other: Reduce Reliability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-108: Struts: Unvalidated Action Form

Description:
Every Action Form must have a corresponding validation form.

Extended Description:
If a Struts Action Form Mapping specifies a form, it must have a validation form defined under the Struts Validator.

Affected languages: Java
Parent weaknesses: CWE-1173, CWE-20

Consequences:
  - Other: Other
  - Confidentiality: Other

Mitigations:
  - [Implementation] Map every Action Form to a corresponding validation form. 
                   An action or a form may perform validation in other ways, but the Struts Validator provides an excellent way to verify that all input receives at least a basic level of validation. Without this approach, it is difficult, a
CWE-1080: Source Code File with Excessive Number of Lines of Code

Description:
A source code file has too many lines of
					code.

Extended Description:
While the interpretation of "too many lines of code" may vary for each product or developer, CISQ recommends a default threshold value of 1000.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1082: Class Instance Self Destruction Control Element

Description:
The code contains a class instance that calls the method or function to delete or destroy itself.

Extended Description:
For example, in C++, "delete this" will cause the object to delete itself.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1076

Consequences:
  - Other: Reduce Reliability
CWE-1083: Data Access from Outside Expected Data Manager Component

Description:
The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component.

Extended Description:
When the product has a data access component, the design may be intended to handle all data access operations through that component.  If a data access operation is performed outside of that component, then this may indicate a violation of the intended design.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1061

Consequences:
  - Other: Reduce Reliability
CWE-1084: Invokable Control Element with Excessive File or Data Access Operations

Description:
A function or method contains too many
					operations that utilize a data manager or file resource.

Extended Description:
While the interpretation of "too many operations" may vary for each product or developer, CISQ recommends a default maximum of 7 operations for the same data manager or file.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-405

Consequences:
  - Other: Reduce Maintainability
CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code

Description:
A function, method, procedure, etc. contains an excessive amount of code that has been
					commented out within its body.

Extended Description:
While the interpretation of "excessive volume" may vary for each product or developer, CISQ recommends a default threshold of 2% of commented code.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1078

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1086: Class with Excessive Number of Child Classes

Description:
A class contains an unnecessarily large number of
					children.

Extended Description:
While the interpretation of "large number of children" may vary for each product or developer, CISQ recommends a default maximum of 10 child classes.

Affected languages: Object-Oriented
Parent weaknesses: CWE-1093

Consequences:
  - Other: Reduce Maintainability
CWE-1087: Class with Virtual Method without a Virtual Destructor

Description:
A class contains a virtual method, but the method does not have an associated virtual destructor.

Affected languages: Object-Oriented
Parent weaknesses: CWE-1076

Consequences:
  - Other: Reduce Reliability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1088: Synchronous Access of Remote Resource without Timeout

Description:
The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-821

Consequences:
  - Other: Reduce Reliability

Real-world examples:
  - CVE-2024-8062: API endpoint performs a HEAD request without a timeout, allowing attackers to cause the server to hang
  - CVE-2024-8061: development product for AI can make requests to external servers without timeouts and does not respond to other requests while waiting, allowing DoS
CWE-1089: Large Data Table with Excessive Number of Indices

Description:
The product uses a large data table that contains an excessively large number of
					indices.

Extended Description:
While the interpretation of "large data table" and "excessively large number of indices" may vary for each product or developer, CISQ recommends a default threshold of 1000000 rows for a "large" table and a default threshold of 3 indices.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-405

Consequences:
  - Other: Reduce Performance
CWE-109: Struts: Validator Turned Off

Description:
Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.

Affected languages: Java
Parent weaknesses: CWE-1173, CWE-20

Consequences:
  - Access Control: Bypass Protection Mechanism

Mitigations:
  - [Implementation] Ensure that an action form mapping enables validation. Set the validate field to true.

Demonstrative examples:
This mapping defines an action for a download form:
This mapping has disabled validation. Disabling validation exposes this action to numerous types of attacks.
<action path="/download" type="com.website.d2.action.DownloadAction" name="downloadForm" scope="request" input=".download" validate="false"> </action>
CWE-1090: Method Containing Access of a Member Element from Another Class

Description:
A method for a class performs an operation that directly
					accesses a member element from another class.

Affected languages: Object-Oriented
Parent weaknesses: CWE-1061

Consequences:
  - Other: Reduce Maintainability
CWE-1091: Use of Object without Invoking Destructor Method

Description:
The product contains a method that accesses an object but does not later invoke
					the element's associated finalize/destructor method.

Affected languages: Object-Oriented
Parent weaknesses: CWE-772, CWE-1076

Consequences:
  - Other: Reduce Performance

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1092: Use of Same Invokable Control Element in Multiple Architectural Layers

Description:
The product uses the same control element across multiple
					architectural layers.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability
CWE-1093: Excessively Complex Data Representation

Description:
The product uses an unnecessarily complex internal representation for its data structures or interrelationships between those structures.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability
  - Other: Reduce Performance
CWE-1094: Excessive Index Range Scan for a Data Resource

Description:
The product contains an index range scan for a large data table,
					but the scan can cover a large number of rows.

Extended Description:
While the interpretation of "large data table" and "excessive index range" may vary for each product or developer, CISQ recommends a threshold of 1000000 table rows and a threshold of 10 for the index range.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-405

Consequences:
  - Other: Reduce Performance
CWE-1095: Loop Condition Value Update within the Loop

Description:
The product uses a loop with a control flow condition based on
					a value that is updated within the body of the loop.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Maintainability
CWE-1096: Singleton Class Instance Creation without Proper Locking or Synchronization

Description:
The product implements a Singleton design pattern but does not use appropriate locking or other synchronization mechanism to ensure that the singleton class is only instantiated once.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-820, CWE-662, CWE-662

Consequences:
  - Other: Reduce Reliability
CWE-1097: Persistent Storable Data Element without Associated Comparison Control Element

Description:
The product uses a storable data element that does not have
					all of the associated functions or methods that are necessary to support
					comparison.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1076, CWE-595

Consequences:
  - Other: Reduce Reliability
CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element

Description:
The code contains a data element with a pointer that does not have an associated copy or constructor method.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1076

Consequences:
  - Other: Reduce Reliability
CWE-1099: Inconsistent Naming Conventions for Identifiers

Description:
The product's code, documentation, or other artifacts do not
					consistently use the same naming conventions for variables, callables, groups of
					related callables, I/O capabilities, data types, file names, or similar types of
					elements.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1078

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-11: ASP.NET Misconfiguration: Creating Debug Binary

Description:
Debugging messages help attackers learn about the system and plan a form of attack.

Extended Description:
ASP .NET applications can be configured to produce debug binaries. These binaries give detailed debugging messages and should not be used in production environments. Debug binaries are meant to be used in a development or testing environment and can pose a security risk if they are deployed to production.

Affected languages: ASP.NET
Parent weaknesses: CWE-489

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [System Configuration] Avoid releasing debug binaries into the production environment. Change the debug mode to false when the application is deployed into production.

Demonstrative examples:
The file web.config contains the debug mode setting. Setting debug to "true" will let the browser display debugging information.
Change the debug mode to false when the application is deployed into production.
<?xml version="1.0" encoding="utf-8" ?> <configuration> <system.web> <compilation defaultLanguage="c#" debug="true" /> ... </system.web> </configuration>
CWE-110: Struts: Validator Without Form Field

Description:
Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date.

Extended Description:
It is easy for developers to forget to update validation logic when they make changes to an ActionForm class. One indication that validation logic is not being properly maintained is inconsistencies between the action form and the validation form. 
             Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.

Affected languages: Java
Parent weaknesses: CWE-1164, CWE-20

Consequences:
  - Other: Other

Detection methods:
  - Automated Static Analysis: To find the issue in the implementation, manual checks or automated static analysis could be applied to the XML configuration files.
  - Manual Static Analysis: To find the issue in the implementation, manual checks or automated static analysis could be applied to the XML configuration files.

Demonstrative examples:
This example shows an inconsistency between an action form and a validation form. with a third field.
This first block of code shows an action form that has two fields, startDate and endDate.
public class DateRangeForm extends ValidatorForm { 
                         String startDate, endDate; 
                            public void setStartDate(String startDate) { this.startDate = startDate; } 
                            public void setEndDate(String endDate) { this.endDate = endDate; } 
                      }
<form name="DateRangeForm"> <field property="startDate" depends="date"> <arg0 key="start.date"/> </field> <field property="endDate" depends="date"> <arg0 key="end.date"/> </field> <field property="scale" depends="integer"> <arg0 key="range.scale"/> </field> </form>
CWE-1100: Insufficient Isolation of System-Dependent Functions

Description:
The product or code does not isolate system-dependent
					functionality into separate standalone modules.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1061

Consequences:
  - Other: Reduce Maintainability
CWE-1101: Reliance on Runtime Component in Generated Code

Description:
The product uses automatically-generated code that cannot be
					executed without a specific runtime support component.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability
CWE-1102: Reliance on Machine-Dependent Data Representation

Description:
The code uses a data representation that relies on low-level
					data representation or constructs that may vary across different processors,
					physical machines, OSes, or other physical components.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-758

Consequences:
  - Other: Reduce Maintainability

Real-world examples:
  - CVE-2025-47153: Chain: build process for JavaScript runtime environment can have inconsistent sizes for off_t (CWE-1102), allowing out-of-bounds access / segmentation fault (CWE-119)
CWE-1103: Use of Platform-Dependent Third Party Components

Description:
The product relies on third-party components that do
					not provide equivalent functionality across all desirable
					platforms.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-758

Consequences:
  - Other: Reduce Maintainability
CWE-1104: Use of Unmaintained Third Party Components

Description:
The product relies on third-party components that are not
					actively supported or maintained by the original developer or a trusted proxy
					for the original developer.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, ICS/OT
Parent weaknesses: CWE-1357

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Real-world examples:
  - CVE-2025-40906: Perl module for BSON serialization includes a component that reached end-of-life approximately five years previously, but has multiple vulnerabilities.
  - CVE-2024-35252: Closed-source cloud storage product includes an unmaintained third-party component that allows denial of service
CWE-1105: Insufficient Encapsulation of Machine-Dependent Functionality

Description:
The product or code uses machine-dependent functionality, but
					it does not sufficiently encapsulate or isolate this functionality from
					the rest of the code.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-758, CWE-1061

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
In this example function, the memory address of variable b is derived by adding 1 to the address of variable a. This derived address is then used to assign the value 0 to b.
Here, b may not be one byte past a. It may be one byte in front of a. Or, they may have three bytes between them because they are aligned on 32-bit boundaries.
void example() { char a; char b; *(&a + 1) = 0; }
CWE-1106: Insufficient Use of Symbolic Constants

Description:
The source code uses literal constants that may need to change
					or evolve over time, instead of using symbolic constants.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1078

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
The usage of symbolic names instead of hard-coded constants is preferred.
The following is an example of using a hard-coded constant instead of a symbolic name.
char buffer[1024]; ... fgets(buffer, 1024, stdin);
enum { MAX_BUFFER_SIZE = 1024 }; ... char buffer[MAX_BUFFER_SIZE]; ... fgets(buffer, MAX_BUFFER_SIZE, stdin);
CWE-1107: Insufficient Isolation of Symbolic Constant Definitions

Description:
The source code uses symbolic constants, but it does not
					sufficiently place the definitions of these constants into a more centralized or
					isolated location.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1078

Consequences:
  - Other: Reduce Maintainability
CWE-1108: Excessive Reliance on Global Variables

Description:
The code is structured in a way that relies too much on using
					or setting global variables throughout various points in the code, instead of
					preserving the associated information in a narrower, more local
					context.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1076

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1109: Use of Same Variable for Multiple Purposes

Description:
The code contains a callable, block, or other code element in
					which the same variable is used to control more than one unique task or store
					more than one instance of data.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1078

Consequences:
  - Other: Reduce Maintainability
  - Other: Increase Analytical Complexity

Real-world examples:
  - CVE-2023-26463: Chain: IPSec VPN product uses the same variable for multiple purposes in the same function (CWE-1109), leading to incorrect access control (CWE-284) and expired pointer dereference (CWE-825)