deardaniel/secdata-raw huggingface dataset:
CWE-1431: Driving Intermediate Cryptographic State/Results to Hardware Module Outputs

Description:
The product uses a hardware module implementing a cryptographic
		  algorithm that writes sensitive information about the intermediate
		  state or results of its cryptographic operations via one of its output
		  wires (typically the output port containing the final result).

Affected languages: Not Language-Specific
Affected technologies: System on Chip
Parent weaknesses: CWE-200

Consequences:
  - Confidentiality: Read Memory

Detection methods:
  - Automated Static Analysis - Source Code: Automated static analysis can find some instances of this
			    weakness by analyzing source register-transfer level (RTL) code
			    without having to simulate it or analyze it with a formal verifi
  - Simulation / Emulation: Simulation/emulation based analysis can find some instances of
			    this weakness by simulating source register-transfer level (RTL) code
			    along with a set of assertions that incorporate the s
  - Formal Verification: Formal verification can find some instances of this weakness by
			    exhaustively analyzing whether a given assertion holds true for a
			    given hardware design specified in register-transfer lev
  - Manual Analysis: Manual analysis can find some instances of this weakness by
			    manually reviewing relevant lines of source register-transfer level
			    (RTL) code to detect potentially-vulnerable patterns. Typi

Mitigations:
  - [Architecture and Design] Designers/developers
			    should add or modify existing control flow
			    logic along any data flow paths that
			    connect "sources" (signals with
			    intermediate cryptographic state/results)
			    with "sinks" (hardware module outputs and
			    other signals outside of trusted
			    c
  - [Implementation] Designers/developers
			    should add or modify existing control flow
			    logic along any data flow paths that
			    connect "sources" (signals with
			    intermediate cryptographic state/results)
			    with "sinks" (hardware module outputs and
			    other signals outside of trusted
			    c

Demonstrative examples:
The following SystemVerilog code is a crypto module that takes input
			    data and encrypts it by processing the data through multiple
			    encryption rounds. Note: this example is derived from [REF-1469].
In line 50 above, data_state_q is assigned to data_o. Since data_state_q
			    contains intermediate state/results, this allows an attacker to obtain
			    these results through data_o.
01 | module crypto_core_with_leakage 
			      02 | ( 
			       
				03 |     input  clk, 
				04 |     input  rst, 
				05 |     input  [127:0] data_i, 
				06 |     output [127:0] data_o, 
				07 |     output valid 
			       
			      08 | ); 
			      09 | 
			      10 | localparam int total_rounds = 10; 
			      11 | logic [3:0]   round_id_q; 
			      12 | logic [127:0] data_state_q, data_st
CWE-1434: Insecure Setting of Generative AI/ML Model Inference Parameters

Description:
The product has a component that relies on a
	  generative AI/ML model configured with inference parameters that
	  produce an unacceptably high rate of erroneous or unexpected
	  outputs.

Extended Description:
Generative AI/ML models, such as those used for text
		generation, image synthesis, and other creative tasks, rely on
		inference parameters that control model behavior, such as
		temperature, Top P, and Top K.  These parameters affect the
		model's internal decision-making processes, learning rate, and
		probability distributions. Incorrect settings can lead to
		unusual behavior such as text "hallucinations," unrealistic
		images, or failure to converge during training. The impact of
		such misconfigurations can compromise the integrity of the
		application. If the results are used in security-critical
		operations or decisions, then this could violate the intended
		security policy, i.e., introduce a vulnerability.

Affected languages: Not Language-Specific
Affected technologies: AI/ML, Not Technology-Specific
Parent weaknesses: CWE-440, CWE-665

Consequences:
  - Integrity: Varies by Context
  - Other: Alter Execution Logic

Detection methods:
  - Automated Dynamic Analysis: Manipulate inference parameters and perform
            comparative evaluation to assess the impact of selected
            values. Build a suite of systems using targeted tools that
            detec
  - Manual Dynamic Analysis: Manipulate inference parameters and perform
            comparative evaluation to assess the impact of selected
            values. Build a suite of systems using targeted tools that
            detec

Mitigations:
  - [Implementation] Develop and adhere to robust parameter tuning
			processes that include extensive testing and
			validation.
  - [Implementation] Implement feedback mechanisms to continuously
			assess and adjust model performance.
  - [Documentation] Provide comprehensive documentation and
			guidelines for parameter settings to ensure consistent and
			accurate model behavior.

Demonstrative examples:
Assume the product offers an
			LLM-based AI coding assistant to help users to write code
			as part of an Integrated Development Environment (IDE).
			Assume the model has been trained on real-world code, and
			the model behaves normally under its default settings.
			Suppose there is a default temperature of 1, with a range
			of temperature values from 0 (most deterministic) to
			2. 
			 Consider the following configuration.
The problem is that the configuration contains a temperature
			hyperparameter that is higher than the default. This significantly
			increases the likelihood that the LLM will suggest a package that did
			not exist at training time, a behavior sometimes referred to as
			"package hallucination."  Note that other possible behaviors could
			arise from higher temp
CWE-144: Improper Neutralization of Line Delimiters

Description:
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component.

Extended Description:
As data is parsed, an injected/absent/malformed delimiter may cause the process to take unexpected actions.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-140

Consequences:
  - Integrity: Unexpected State

Mitigations:
  - Developers should anticipate that line delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i

Real-world examples:
  - CVE-2002-0267: Linebreak in field of PHP script allows admin privileges when written to data file.
CWE-145: Improper Neutralization of Section Delimiters

Description:
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as section delimiters when they are sent to a downstream component.

Extended Description:
As data is parsed, an injected/absent/malformed delimiter may cause the process to take unexpected actions. 
             One example of a section delimiter is the boundary string in a multipart MIME message. In many cases, doubled line delimiters can serve as a section delimiter.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-140

Consequences:
  - Integrity: Unexpected State

Mitigations:
  - Developers should anticipate that section delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i
CWE-146: Improper Neutralization of Expression/Command Delimiters

Description:
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

Extended Description:
As data is parsed, an injected/absent/malformed delimiter may cause the process to take unexpected actions.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-140

Consequences:
  - Confidentiality: Execute Unauthorized Code or Commands

Mitigations:
  - Developers should anticipate that inter-expression and inter-command delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i
CWE-147: Improper Neutralization of Input Terminators

Description:
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.

Extended Description:
For example, a "." in SMTP signifies the end of mail message data, whereas a null character can be used for the end of a string.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-138

Consequences:
  - Integrity: Unexpected State

Mitigations:
  - Developers should anticipate that terminators will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i

Real-world examples:
  - CVE-2000-0319: MFV. mail server does not properly identify terminator string to signify end of message, causing corruption, possibly in conjunction with off-by-one error.
  - CVE-2000-0320: MFV. mail server does not properly identify terminator string to signify end of message, causing corruption, possibly in conjunction with off-by-one error.
  - CVE-2001-0996: Mail server does not quote end-of-input terminator if it appears in the middle of a message.
  - CVE-2002-0001: Improperly terminated comment or phrase allows commands.
CWE-148: Improper Neutralization of Input Leaders

Description:
The product does not properly handle when a leading character or sequence ("leader") is missing or malformed, or if multiple leaders are used when only one should be allowed.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-138

Consequences:
  - Integrity: Unexpected State

Mitigations:
  - Developers should anticipate that leading characters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i
CWE-149: Improper Neutralization of Quoting Syntax

Description:
Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-138

Consequences:
  - Integrity: Unexpected State

Mitigations:
  - Developers should anticipate that quotes will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i

Real-world examples:
  - CVE-2004-0956: Database allows remote attackers to cause a denial of service (application crash) via a MATCH AGAINST query with an opening double quote but no closing double quote.
  - CVE-2003-1016: MIE. MFV too? bypass AV/security with fields that should not be quoted, duplicate quotes, missing leading/trailing quotes.
CWE-15: External Control of System or Configuration Setting

Description:
One or more system settings or configuration elements can be externally controlled by a user.

Extended Description:
Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.
Affected technologies: Not Technology-Specific, ICS/OT
Parent weaknesses: CWE-642, CWE-610, CWE-20

Consequences:
  - Other: Varies by Context

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. 
                   Ensure that appropriate compartm
  - [Implementation] Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system va
  - [Implementation] In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.

Demonstrative examples:
The following C code accepts a number as one of its command line parameters and sets it as the host ID of the current machine.
Although a process must be privileged to successfully invoke sethostid(), unprivileged users may be able to invoke the program. The code in this example allows user input to directly control the value of a system setting. If an attacker provides a malicious value for host ID, the attacker can misidentify the affected machine on the network or cause other unintended behavior.
... sethostid(argv[1]); ...

The following Java code snippet reads a string from an HttpServletRequest and sets it as the active catalog for a database Connection.
In this example, an attacker could cause an error by providing a nonexistent catalog name or connect to an unauthorized portion of the database.
... conn.setCatalog(request.getParameter("catalog")); ...
CWE-151: Improper Neutralization of Comment Delimiters

Description:
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment delimiters when they are sent to a downstream component.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-138

Consequences:
  - Integrity: Unexpected State

Mitigations:
  - Developers should anticipate that comments will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i

Real-world examples:
  - CVE-2002-0001: Mail client command execution due to improperly terminated comment in address list.
  - CVE-2004-0162: MIE. RFC822 comment fields may be processed as other fields by clients.
  - CVE-2004-1686: Well-placed comment bypasses security warning.
  - CVE-2005-1909: Information hiding using a manipulation involving injection of comment code into product. Note: these vulnerabilities are likely vulnerable to more general XSS problems, although a regexp might allow 
  - CVE-2005-1969: Information hiding using a manipulation involving injection of comment code into product. Note: these vulnerabilities are likely vulnerable to more general XSS problems, although a regexp might allow