deardaniel/secdata-raw huggingface dataset:
CWE-1049: Excessive Data Query Operations in a Large Data Table

Description:
The product performs a data query with a large number of joins
					and sub-queries on a large data table.

Extended Description:
While the interpretation of "large data table" and "large number of joins or sub-queries" may vary for each product or developer, CISQ recommends a default of 1 million rows for a "large" data table, a default minimum of 5 joins, and a default minimum of 3 sub-queries.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1176

Consequences:
  - Other: Reduce Performance
CWE-105: Struts: Form Field Without Validator

Description:
The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.

Extended Description:
Omitting validation for even a single input field may give attackers the leeway they need to compromise the product. Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.

Affected languages: Java
Parent weaknesses: CWE-1173, CWE-20

Consequences:
  - Integrity: Unexpected State
  - Integrity: Bypass Protection Mechanism

Mitigations:
  - [Implementation] Validate all form fields. If a field is unused, it is still important to constrain it so that it is empty or undefined.

Demonstrative examples:
In the following example the Java class RegistrationForm is a Struts framework ActionForm Bean that will maintain user input data from a registration webpage for an online business site. The user will enter registration data and, through the Struts framework, the RegistrationForm bean will maintain the user data in the form fields using the private member variables. The RegistrationForm class uses the Struts validation capability by extending the ValidatorForm class and including the validation for the form fields within the validator XML file, validator.xml.
The validator XML file, validator.xml, provides the validation for the form fields of the RegistrationForm.
public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {
CWE-1050: Excessive Platform Resource Consumption within a Loop

Description:
The product has a loop body or loop condition that contains a control element that directly or
					indirectly consumes platform resources, e.g. messaging, sessions, locks, or file
					descriptors.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-405

Consequences:
  - Availability: DoS: Resource Consumption (CPU)
CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data

Description:
The product initializes data using hard-coded values that act as network resource identifiers.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1419

Consequences:
  - Other: Reduce Reliability
CWE-1052: Excessive Use of Hard-Coded Literals in Initialization

Description:
The product initializes a data element using a hard-coded
					literal that is not a simple integer or static constant element.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1419

Consequences:
  - Other: Reduce Maintainability
CWE-1053: Missing Documentation for Design

Description:
The product does not have documentation that represents how it is designed.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1059

Consequences:
  - Other: Reduce Maintainability
CWE-1054: Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer

Description:
The code at one architectural layer invokes code that resides
					at a deeper layer than the adjacent layer, i.e., the invocation skips at least one
					layer, and the invoked code is not part of a vertical utility layer that can be referenced from any horizontal layer.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1061

Consequences:
  - Other: Reduce Maintainability
CWE-1055: Multiple Inheritance from Concrete Classes

Description:
The product contains a class with inheritance from more than
					one concrete class.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1093

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1056: Invokable Control Element with Variadic Parameters

Description:
A named-callable or method control element has a signature that
					supports a variable (variadic) number of parameters or arguments.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Reliability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1057: Data Access Operations Outside of Expected Data Manager Component

Description:
The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1061

Consequences:
  - Availability: Reduce Performance
CWE-1058: Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element

Description:
The code contains a function or method that
		 operates in a multi-threaded environment but owns an unsafe non-final
		                     static storable or member data element.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-662, CWE-662, CWE-662

Consequences:
  - Other: Reduce Reliability
CWE-1059: Insufficient Technical Documentation

Description:
The product does not contain sufficient
         technical or engineering documentation (whether on paper or
         in electronic form) that contains descriptions of all the
         relevant software/hardware elements of the product, such as
         its usage, structure, architectural components, interfaces, design, implementation,
         configuration, operation, etc.

Extended Description:
When technical documentation is limited or lacking, products are more difficult to maintain.  This indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. 
	  When using time-limited or labor-limited third-party/in-house security consulting services (such as threat modeling, vulnerability discovery, or pentesting), insufficient documentation can force those consultants to invest unnecessary time in learning how the product is organized, instead of focusing their expertise on finding the flaws or suggesting effective mitigations. 
	  With respect to hardware design, the lack of a formal, final manufacturer reference can make it difficult or impossible to evaluate the final product, including post-manufacture verification. One cannot ensure that design functionality or operation is within acceptable tolerances, conforms to specifications, and is free from unexpected behavior. Hardware-related documentation may include engineering arti

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, ICS/OT
Parent weaknesses: CWE-710

Consequences:
  - Other: Varies by Context

Mitigations:
  - [Documentation] Ensure that design documentation is detailed enough to allow for post-manufacturing verification.

Real-world examples:
  - CVE-2022-3203: A wireless access point manual specifies that the only method of configuration is via web interface (CWE-1059), but there is an undisclosed telnet server that was activated by default (CWE-912).
CWE-106: Struts: Plug-in Framework not in Use

Description:
When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.

Extended Description:
Unchecked input is the leading cause of vulnerabilities in J2EE applications. Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others. 
             Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.

Affected languages: Java
Parent weaknesses: CWE-1173, CWE-20

Consequences:
  - Integrity: Unexpected State

Mitigations:
  - [Architecture and Design] Use an input validation framework such as Struts.
  - [Architecture and Design] Use an input validation framework such as Struts.
  - [Implementation] Use the Struts Validator to validate all program input before it is processed by the application. Ensure that there are no holes in the configuration of the Struts Validator. Example uses of the validator include checking to ensure that: 
                      
                         Phone number 
  - [Implementation] Use the Struts Validator to validate all program input before it is processed by the application. Ensure that there are no holes in the configuration of the Struts Validator. Example uses of the validator include checking to ensure that: 
                      
                         Phone number 

Demonstrative examples:
In the following Java example the class RegistrationForm is a Struts framework ActionForm Bean that will maintain user input data from a registration webpage for an online business site. The user will enter registration data and, through the Struts framework, the RegistrationForm bean will maintain the user data.
However, the RegistrationForm class extends the Struts ActionForm class which does use the Struts validator plug-in to provide validator capabilities. In the following example, the RegistrationForm Java class extends the ValidatorForm and Struts configuration XML file, struts-config.xml, instructs the application to use the Struts validator plug-in.
public class RegistrationForm extends org.apache.struts.action.ActionForm { 
                         
                         // pr
CWE-1060: Excessive Number of Inefficient Server-Side Data Accesses

Description:
The product performs too many data queries without using efficient data processing functionality such as stored procedures.

Extended Description:
While the interpretation of "too many data queries" may vary for each product or developer, CISQ recommends a default maximum of 5 data queries for an inefficient function/procedure.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Performance
CWE-1061: Insufficient Encapsulation

Description:
The product does not sufficiently hide the internal representation and implementation details of data or methods, which might allow external components or modules to modify data unexpectedly, invoke unexpected functionality, or introduce dependencies that the programmer did not intend.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Access Control: Varies by Context
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
The following example shows a basic user account class that includes member variables for the username and password as well as a public constructor for the class and a public method to authorize access to the user account.
However, the member variables username and password are declared public and therefore will allow access and changes to the member variables to anyone with access to the object. These member variables should be declared private as shown below to prevent unauthorized access and changes.
#define MAX_PASSWORD_LENGTH 15 #define MAX_USERNAME_LENGTH 15 
                class UserAccount { 
                public: 
                UserAccount(char *username, char *password) { if ((strlen(username) > MAX_USERNAME_LENGTH) || (strlen(password) > MAX_PASSWORD_LENGTH)) { ExitError("I

Real-world examples:
  - CVE-2010-3860: variables declared public allow remote read of system properties such as user name and home directory.
CWE-1062: Parent Class with References to Child Class

Description:
The code has a parent class that contains references to a child class, its methods, or its members.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1061

Consequences:
  - Other: Reduce Reliability
CWE-1063: Creation of Class Instance within a Static Code Block

Description:
A static code block creates an instance of a class.

Extended Description:
This pattern identifies situations where a storable data element or member data element is initialized with a value in a block of code which is declared as static.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1176

Consequences:
  - Other: Reduce Performance
CWE-1064: Invokable Control Element with Signature Containing an Excessive Number of Parameters

Description:
The product contains a function, subroutine, or method whose signature has an unnecessarily large number of
					parameters/arguments.

Extended Description:
While the interpretation of "large number of parameters" may vary for each product or developer, CISQ recommends a default maximum of 7 parameters/arguments.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1065: Runtime Resource Management Control Element in a Component Built to Run on Application Servers

Description:
The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Reliability
CWE-1066: Missing Serialization Control Element

Description:
The product contains a serializable data element that does not
					have an associated serialization method.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Reliability
CWE-1067: Excessive Execution of Sequential Searches of Data Resource

Description:
The product contains a data query against an SQL table or view
					that is configured in a way that does not utilize an index and may cause
					sequential searches to be performed.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1176

Consequences:
  - Availability: Reduce Performance
CWE-1068: Inconsistency Between Implementation and Documented Design

Description:
The implementation of the product is not consistent with the
					design as described within the relevant documentation.
Affected technologies: Not Technology-Specific, ICS/OT
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability
CWE-1069: Empty Exception Block

Description:
An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1071

Consequences:
  - Other: Reduce Reliability

Mitigations:
  - [Implementation] For every exception block add code that handles the specific exception in the way intended by the application.

Demonstrative examples:
In the following Java example, the code catches an ArithmeticException.
Since the exception block is empty, no action is taken.
public class Main { 
                      public static void main(String[] args) {
                         int a = 1;
                         int b = 0;
                         int c = 0; 
                         try {
                            c = a / b; 
                         } catch(ArithmeticException ae) {
                         } 
                      } 
                   }
public class Main { 
                      public static void main(String[] args) {
                         int a = 1;
                         int b = 0;
                         int c = 0; 
                         try {
                            c = a / b;
CWE-107: Struts: Unused Validation Form

Description:
An unused validation form indicates that validation logic is not up-to-date.

Affected languages: Java
Parent weaknesses: CWE-1164, CWE-20

Consequences:
  - Other: Quality Degradation

Mitigations:
  - [Implementation] Remove the unused Validation Form from the validation.xml file.

Demonstrative examples:
In the following example the class RegistrationForm is a Struts framework ActionForm Bean that will maintain user input data from a registration webpage for an online business site. The user will enter registration data and, through the Struts framework, the RegistrationForm bean will maintain the user data in the form fields using the private member variables. The RegistrationForm class uses the Struts validation capability by extending the ValidatorForm class and including the validation for the form fields within the validator XML file, validator.xml.
However, the validator XML file, validator.xml, for the RegistrationForm class includes the validation form for the user input form field "phone" that is no longer used by the input form and the RegistrationForm class. Any validation forms
CWE-1070: Serializable Data Element Containing non-Serializable Item Elements

Description:
The product contains a serializable, storable data element such as a field or member,
					but the data element contains member elements that are not
					serializable.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1076

Consequences:
  - Other: Reduce Reliability
CWE-1071: Empty Code Block

Description:
The source code contains a block that does not contain any code, i.e., the block is empty.

Extended Description:
Empty code blocks can occur in the bodies of conditionals, function or method definitions, exception handlers, etc.  While an empty code block might be intentional, it might also indicate incomplete implementation, accidental code deletion, unexpected macro expansion, etc.  For some programming languages and constructs, an empty block might be allowed by the syntax, but the lack of any behavior within the block might violate a convention or API in such a way that it is an error.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1164

Consequences:
  - Other: Reduce Reliability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
In the following Java example, the code catches an ArithmeticException.
Since the exception block is empty, no action is taken.
public class Main { 
                      public static void main(String[] args) {
                         int a = 1;
                         int b = 0;
                         int c = 0; 
                         try {
                            c = a / b; 
                         } catch(ArithmeticException ae) {
                         } 
                      } 
                   }
public class Main { 
                      public static void main(String[] args) {
                         int a = 1;
                         int b = 0;
                         int c = 0; 
                         try {
                            c = a / b; 
           

The following code attempts to synchronize on an object, but does not execute anything in the synchronized block. This does not actually accomplish anything and may be a sign that a programmer is wrestling with synchronization but has not yet achieved the result they intend.
Instead, in a correct usage, the synchronized statement should contain procedures that access or modify data that is exposed to multiple threads. For example, consider a scenario in which several threads are accessing student records at the same time. The method which sets the student ID to a new value will need to make sure that nobody else is accessing this data at the same time and will require synchronization.
synchronized(this) { }
public void setID(int ID){ synchronized(this){ this.ID = ID; } }
CWE-1072: Data Resource Access without Use of Connection Pooling

Description:
The product accesses a data resource through a database without using a
					connection pooling capability.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-405

Consequences:
  - Other: Reduce Performance
CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses

Description:
The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities.

Extended Description:
While the interpretation of "large number of data accesses/queries" may vary for each product or developer, CISQ recommends a default maximum of 2 data accesses per function/method.

Affected languages: SQL
Affected technologies: Database Server
Parent weaknesses: CWE-405

Consequences:
  - Other: Reduce Performance
CWE-1074: Class with Excessively Deep Inheritance

Description:
A class has an inheritance level that is too high, i.e., it
					has a large number of parent classes.

Extended Description:
While the interpretation of "large number of parent classes" may vary for each product or developer, CISQ recommends a default maximum of 7 parent classes.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1093

Consequences:
  - Other: Reduce Maintainability
CWE-1075: Unconditional Control Flow Transfer outside of Switch Block

Description:
The product performs unconditional control transfer (such as a
					"goto") in code outside of a branching structure such as a switch
					block.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1120

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-1076: Insufficient Adherence to Expected Conventions

Description:
The product's architecture, source code, design, documentation,
					or other artifact does not follow required conventions.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Reduce Maintainability

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
The usage of symbolic names instead of hard-coded constants is preferred.
The following is an example of using a hard-coded constant instead of a symbolic name.
char buffer[1024]; ... fgets(buffer, 1024, stdin);
enum { MAX_BUFFER_SIZE = 1024 }; ... char buffer[MAX_BUFFER_SIZE]; ... fgets(buffer, MAX_BUFFER_SIZE, stdin);

The following code fragment calls finalize() explicitly:

// time to clean up 
                      widget.finalize();