deardaniel/secdata-raw huggingface dataset:
CWE-436: Interpretation Conflict

Description:
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Extended Description:
This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-435

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
The paper "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection" [REF-428] shows that OSes varied widely in how they manage unusual packets, which made it difficult or impossible for intrusion detection systems to properly detect certain attacker manipulations that took advantage of these OS differences.

Null characters have different interpretations in Perl and C, which have security consequences when Perl invokes C functions. Similar problems have been reported in ASP [REF-429] and PHP.

Real-world examples:
  - CVE-2005-1215: Bypass filters or poison web cache using requests with multiple Content-Length headers, a non-standard behavior.
  - CVE-2002-0485: Anti-virus product allows bypass via Content-Type and Content-Disposition headers that are mixed case, which are still processed by some clients.
  - CVE-2002-1978: FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
  - CVE-2002-1979: FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
  - CVE-2002-0637: Virus product bypass with spaces between MIME header fields and the ":" separator, a non-standard message that is accepted by some clients.
CWE-437: Incomplete Model of Endpoint Features

Description:
A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-436

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
HTTP request smuggling is an attack against an intermediary such as a proxy. This attack works because the proxy expects the client to parse HTTP headers one way, but the client parses them differently.

Anti-virus products that reside on mail servers can suffer from this issue if they do not know how a mail client will handle a particular attachment. The product might treat an attachment type as safe, not knowing that the client's configuration treats it as executable.

Real-world examples:
  - CVE-2024-55629: network-based IDS does not model how TCP endpoints handle TCP urgent data, allowing attackers to bypass detection
CWE-439: Behavioral Change in New Version or Environment

Description:
A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-435

Consequences:
  - Other: Quality Degradation

Real-world examples:
  - CVE-2002-1976: Linux kernel 2.2 and above allow promiscuous mode using a different method than previous versions, and ifconfig is not aware of the new method (alternate path property).
  - CVE-2005-1711: Product uses defunct method from another product that does not return an error code and allows detection avoidance.
  - CVE-2003-0411: chain: Code was ported from a case-sensitive Unix platform to a case-insensitive Windows platform where filetype handlers treat .jsp and .JSP as different extensions. JSP source code may be read becau
CWE-44: Path Equivalence: 'file.name' (Internal Dot)

Description:
The product accepts path input in the form of internal dot ('file.ordir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-41

Consequences:
  - Confidentiality: Read Files or Directories

Real-world examples:
  - CVE-2025-24813: servlet in Java-based product allows code execution via a "file.Name" internal dot
CWE-440: Expected Behavior Violation

Description:
A feature, API, or function does not perform according to its specification.

Affected languages: Not Language-Specific
Affected technologies: ICS/OT
Parent weaknesses: CWE-684

Consequences:
  - Other: Quality Degradation

Demonstrative examples:
The provided code is extracted from the Control and Status Register (CSR), csr_regfile, module within the Hack@DAC'21 OpenPiton System-on-Chip (SoC). This module is designed to implement CSR registers in accordance with the RISC-V specification. The mie (machine interrupt enable) register is a 64-bit register [REF-1384], where bits correspond to different interrupt sources. As the name suggests, mie is a machine-level register that determines which interrupts are enabled. Note that in the example below the mie_q and mie_d registers represent the conceptual mie reigster in the RISC-V specification. The mie_d register is the value to be stored in the mie register while the mie_q register holds the current value of the mie register [REF-1385].
The mideleg (machine interrupt delegation) regist

Real-world examples:
  - CVE-2003-0187: Program uses large timeouts on unconfirmed connections resulting from inconsistency in linked lists implementations.
  - CVE-2003-0465: "strncpy" in Linux kernel acts different than libc on x86, leading to expected behavior difference - sort of a multiple interpretation error?
  - CVE-2005-3265: Buffer overflow in product stems the use of a third party library function that is expected to have internal protection against overflows, but doesn't.
CWE-446: UI Discrepancy for Security Feature

Description:
The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state.

Extended Description:
When the user interface does not properly reflect what the user asks of it, then it can lead the user into a false sense of security. For example, the user might check a box to enable a security option to enable encrypted communications, but the product does not actually enable the encryption. Alternately, the user might provide a "restrict ALL" access control rule, but the product only implements "restrict SOME".

Affected languages: Not Language-Specific
Parent weaknesses: CWE-684

Consequences:
  - Other: Varies by Context

Real-world examples:
  - CVE-1999-1446: UI inconsistency; visited URLs list not cleared when "Clear History" option is selected.
CWE-447: Unimplemented or Unsupported Feature in UI

Description:
A UI function for a security feature appears to be supported and gives feedback to the user that suggests that it is supported, but the underlying functionality is not implemented.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-446, CWE-671

Consequences:
  - Other: Varies by Context

Mitigations:
  - [Testing] Perform functionality testing before deploying the application.

Real-world examples:
  - CVE-2000-0127: GUI configuration tool does not enable a security option when a checkbox is selected, although that option is honored when manually set in the configuration file.
  - CVE-2001-0863: Router does not implement a specific keyword when it is used in an ACL, allowing filter bypass.
  - CVE-2001-0865: Router does not implement a specific keyword when it is used in an ACL, allowing filter bypass.
  - CVE-2004-0979: Web browser does not properly modify security setting when the user sets it.
CWE-448: Obsolete Feature in UI

Description:
A UI function is obsolete and the product does not warn the user.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-446

Consequences:
  - Other: Quality Degradation

Mitigations:
  - [Architecture and Design] Remove the obsolete feature from the UI. Warn the user that the feature is no longer supported.
CWE-449: The UI Performs the Wrong Action

Description:
The UI performs the wrong action with respect to the user's request.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-446

Consequences:
  - Other: Quality Degradation

Detection methods:
  - Manual Analysis: Perform extensive functionality testing of the UI. The UI should behave as specified.

Real-world examples:
  - CVE-2001-1387: Network firewall accidentally implements one command line option as if it were another, possibly leading to behavioral infoleak.
  - CVE-2001-0081: Command line option correctly suppresses a user prompt but does not properly disable a feature, although when the product prompts the user, the feature is properly disabled.
  - CVE-2002-1977: Product does not "time out" according to user specification, leaving sensitive data available after it has expired.
CWE-45: Path Equivalence: 'file...name' (Multiple Internal Dot)

Description:
The product accepts path input in the form of multiple internal dot ('file...dir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-44, CWE-165

Consequences:
  - Confidentiality: Read Files or Directories
CWE-450: Multiple Interpretations of UI Input

Description:
The UI has multiple interpretations of user input but does not prompt the user when it selects the less secure interpretation.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-357

Consequences:
  - Other: Varies by Context

Mitigations:
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i
CWE-451: User Interface (UI) Misrepresentation of Critical Information

Description:
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Extended Description:
If an attacker can cause the UI to display erroneous data, or to otherwise convince the user to display information that appears to come from a trusted source, then the attacker could trick the user into performing the wrong action. This is often a component in phishing attacks, but other kinds of problems exist. For example, if the UI is used to monitor the security state of a system or network, then omitting or obscuring an important indicator could prevent the user from detecting and reacting to a security-critical event. 
             UI misrepresentation can take many forms: 
                
                   Incorrect indicator: incorrect information is displayed, which prevents the user from understanding the true state of the product or the environment the product is monitoring, especially of potentially-dangerous conditions or operations. This can be broken down into several different subtypes. 
                   Overlay: an area of the display is intended to give critical 

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-684, CWE-221

Consequences:
  - Non-Repudiation: Hide Activities

Mitigations:
  - [Implementation] Perform data validation (e.g. syntax, length, etc.) before interpreting the data.
  - [Architecture and Design] Create a strategy for presenting information, and plan for how to display unusual characters.

Real-world examples:
  - CVE-2024-27936: Chain: JavaScript-based application removes ANSI escape sequences in a dialog that asks permission for a particular file, causing the wrong filename to be visually presented for user approval (CWE-451
  - CVE-2004-2227: Web browser's filename selection dialog only shows the beginning portion of long filenames, which can trick users into launching executables with dangerous extensions.
  - CVE-2001-0398: Attachment with many spaces in filename bypasses "dangerous content" warning and uses different icon. Likely resultant.
  - CVE-2001-0643: Misrepresentation and equivalence issue.
  - CVE-2005-0593: Lock spoofing from several different weaknesses.
CWE-453: Insecure Default Variable Initialization

Description:
The product, by default, initializes an internal variable with an insecure or less secure value than is possible.

Affected languages: PHP, Not Language-Specific
Parent weaknesses: CWE-1188

Consequences:
  - Integrity: Modify Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [System Configuration] Disable or change default settings when they can be used to abuse the system. Since those default settings are shipped with the product they are likely to be known by a potential attacker who is familiar with the product. For instance, default credentials should be changed or the associated accounts

Demonstrative examples:
This code attempts to login a user using credentials from a POST request:
Because the $authorized variable is never initialized, PHP will automatically set $authorized to any value included in the POST request if register_globals is enabled. An attacker can send a POST request with an unexpected third value 'authorized' set to 'true' and gain authorized status without supplying valid credentials.
// $user and $pass automatically set from POST request 
                      if (login_user($user,$pass)) { $authorized = true; } 
                      ... 
                      
                      if ($authorized) { generatePage(); }
$user = $_POST['user']; $pass = $_POST['pass']; $authorized = false; if (login_user($user,$pass)) { $authorized = true; } 
                      ...

Real-world examples:
  - CVE-2022-36349: insecure default variable initialization in BIOS firmware for a hardware board allows DoS
CWE-454: External Initialization of Trusted Variables or Data Stores

Description:
The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.

Extended Description:
A product system should be reluctant to trust variables that have been initialized outside of its trust boundary, especially if they are initialized by users. The variables may have been initialized incorrectly. If an attacker can initialize the variable, then they can influence what the vulnerable system will do.

Affected languages: PHP, Not Language-Specific
Parent weaknesses: CWE-1419

Consequences:
  - Integrity: Modify Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] A product system should be reluctant to trust variables that have been initialized outside of its trust boundary. Ensure adequate checking (e.g. input validation) is performed when relying on input from outside a trust boundary.
  - [Architecture and Design] Avoid any external control of variables. If necessary, restrict the variables that can be modified using an allowlist, and use a different namespace or naming convention if possible.

Demonstrative examples:
In the Java example below, a system property controls the debug level of the application.
If an attacker is able to modify the system property, then it may be possible to coax the application into divulging sensitive information by virtue of the fact that additional debug information is printed/exposed as the debug level increases.
int debugLevel = Integer.getInteger("com.domain.application.debugLevel").intValue();

This code checks the HTTP POST request for a debug switch, and enables a debug mode if the switch is set.
Any user can activate the debug mode, gaining administrator privileges. An attacker may also use the information printed by the phpinfo() function to further exploit the system. .
$debugEnabled = false; if ($_POST["debug"] == "true"){ $debugEnabled = true; } 
                      /.../ 
                      
                      function login($username, $password){ if($debugEnabled){ echo 'Debug Activated'; phpinfo(); $isAdmin = True; return True; } }

Real-world examples:
  - CVE-2022-43468: WordPress module sets internal variables based on external inputs, allowing false reporting of the number of views
  - CVE-2000-0959: Does not clear dangerous environment variables, enabling symlink attack.
  - CVE-2001-0033: Specify alternate configuration directory in environment variable, enabling untrusted path.
  - CVE-2001-0872: Dangerous environment variable not cleansed.
  - CVE-2001-0084: Specify arbitrary modules using environment variable.
CWE-455: Non-exit on Failed Initialization

Description:
The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-665, CWE-705, CWE-636

Consequences:
  - Integrity: Modify Application Data

Mitigations:
  - [Implementation] Follow the principle of failing securely when an error occurs. The system should enter a state where it is not vulnerable and will not display sensitive error messages to a potential attacker.

Demonstrative examples:
The following code intends to limit certain operations to the administrator only.
If the application is unable to extract the state information - say, due to a database timeout - then the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as equivalent to "0" in the conditional, allowing the original user to perform administrator actions. Even if the attacker cannot directly influence the state data, unexpected errors could cause incorrect privileges to be assigned to a user just by accident.
$username = GetCurrentUser(); $state = GetStateData($username); if (defined($state)) { $uid = ExtractUserID($state); } 
                      
                      # do stuff 
                      if ($uid == 0) { DoAdminThings(); }

Real-world examples:
  - CVE-2005-1345: Product does not trigger a fatal error if missing or invalid ACLs are in a configuration file.
CWE-456: Missing Initialization of a Variable

Description:
The product does not initialize critical variables, which causes the execution environment to use unexpected values.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-909, CWE-665, CWE-665

Consequences:
  - Integrity: Unexpected State

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Ensure that critical variables are initialized before first use [REF-1485].
  - [Requirements] Choose a language that is not susceptible to these issues.

Demonstrative examples:
This function attempts to extract a pair of numbers from a user-supplied string.
This code attempts to extract two integer values out of a formatted, user-supplied input. However, if an attacker were to provide an input of the form:
void parse_data(char *untrusted_input){ 
                         int m, n, error; error = sscanf(untrusted_input, "%d:%d", &m, &n); if ( EOF == error ){ die("Did not specify integer value. Die evil hacker!\n"); } 
                            /* proceed assuming n and m are initialized correctly */ 
                            
                         
                      }
123:

Here, an uninitialized field in a Java class is used in a seldom-called method, which would cause a NullPointerException to be thrown.

private User user; public void someMethod() { 
                         
                            
                            // Do something interesting. 
                            ... 
                            
                            // Throws NPE if user hasn't been properly initialized. 
                            String username = user.getName(); 
                      }

Real-world examples:
  - CVE-2020-6078: Chain: The return value of a function returning a pointer is not checked for success (CWE-252) resulting in the later use of an uninitialized variable (CWE-456) and a null pointer dereference (CWE-476
  - CVE-2019-3836: Chain: secure communications library does not initialize a local variable for a data structure (CWE-456), leading to access of an uninitialized pointer (CWE-824).
  - CVE-2018-14641: Chain: C union member is not initialized (CWE-456), leading to access of invalid pointer (CWE-824)
  - CVE-2009-2692: Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function (CWE-456) causes a crash because of a null pointer dereference (CWE-476)
  - CVE-2020-20739: A variable that has its value set in a conditional statement is sometimes used when the conditional fails, sometimes causing data leakage
CWE-459: Incomplete Cleanup

Description:
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-404, CWE-404

Consequences:
  - Other: Other

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.

Demonstrative examples:
Stream resources in a Java application should be released in a finally block, otherwise an exception thrown before the call to close() would result in an unreleased I/O resource. In the example below, the close() method is called in the try block (incorrect).

try { InputStream is = new FileInputStream(path); byte b[] = new byte[is.available()]; is.read(b); is.close(); } catch (Throwable t) { log.error("Something bad happened: " + t.getMessage()); }

Real-world examples:
  - CVE-2000-0552: World-readable temporary file not deleted after use.
  - CVE-2005-2293: Temporary file not deleted after use, leaking database usernames and passwords.
  - CVE-2002-0788: Interaction error creates a temporary file that can not be deleted due to strong permissions.
  - CVE-2002-2066: Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
  - CVE-2002-2067: Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).