deardaniel/secdata-raw huggingface dataset:
CWE-192: Integer Coercion Error

Description:
Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.

Extended Description:
Several flaws fall under the category of integer coercion errors. For the most part, these errors in and of themselves result only in availability and data integrity issues. However, in some circumstances, they may result in other, more complicated security related flaws, such as buffer overflow conditions.

Affected languages: C, C++, Java, C#
Parent weaknesses: CWE-681

Consequences:
  - Availability: DoS: Resource Consumption (CPU)
  - Integrity: Execute Unauthorized Code or Commands
  - Integrity: Other

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Requirements] A language which throws exceptions on ambiguous data casts might be chosen.
  - [Architecture and Design] Design objects and program flow such that multiple or complex casts are unnecessary
  - [Implementation] Ensure that any data type casting that you must used is entirely understood in order to reduce the plausibility of error in use.

Demonstrative examples:
The following code is intended to read an incoming packet from a socket and extract one or more headers.
The code performs a check to make sure that the packet does not contain too many headers. However, numHeaders is defined as a signed int, so it could be negative. If the incoming packet specifies a value such as -3, then the malloc calculation will generate a negative number (say, -300 if each header can be a maximum of 100 bytes). When this result is provided to malloc(), it is first converted to a size_t type. This conversion then produces a large value such as[PII_REDACTED], which may cause malloc() to fail or to allocate an extremely large amount of memory (CWE-195). With the appropriate negative numbers, an attacker could trick malloc() into using a very small positive number, which t

The following code reads a maximum size and performs validation on that size. It then performs a strncpy, assuming it will not exceed the boundaries of the array. While the use of "short s" is forced in this particular example, short int's are frequently used within real-world code, such as code that processes structured data.
This code first exhibits an example of CWE-839, allowing "s" to be a negative number. When the negative short "s" is converted to an unsigned integer, it becomes an extremely large positive integer. When this converted integer is used by strncpy() it will lead to a buffer overflow (CWE-119).
int GetUntrustedInt () { return(0x0000FFFF); } 
                      void main (int argc, char **argv) { 
                         char path[256]; char *input; int i; short s; u

Real-world examples:
  - CVE-2022-2639: Chain: integer coercion error (CWE-192) prevents a return value from indicating an error, leading to out-of-bounds write (CWE-787)
CWE-194: Unexpected Sign Extension

Description:
The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.

Affected languages: C, C++
Parent weaknesses: CWE-681, CWE-681, CWE-681

Consequences:
  - Integrity: Read Memory

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Avoid using signed variables if you don't need to represent negative values. When negative values are needed, perform validation after you save those values to larger data types, or before passing them to functions that are expecting unsigned values.

Demonstrative examples:
The following code reads a maximum size and performs a sanity check on that size. It then performs a strncpy, assuming it will not exceed the boundaries of the array. While the use of "short s" is forced in this particular example, short int's are frequently used within real-world code, such as code that processes structured data.
This code first exhibits an example of CWE-839, allowing "s" to be a negative number. When the negative short "s" is converted to an unsigned integer, it becomes an extremely large positive integer. When this converted integer is used by strncpy() it will lead to a buffer overflow (CWE-119).
int GetUntrustedInt () { return(0x0000FFFF); } 
                      void main (int argc, char **argv) { 
                         char path[256]; char *input; int i; short 

Real-world examples:
  - CVE-2018-10887: Chain: unexpected sign extension (CWE-194) leads to integer overflow (CWE-190), causing an out-of-bounds read (CWE-125)
  - CVE-1999-0234: Sign extension error produces -1 value that is treated as a command separator, enabling OS command injection.
  - CVE-2003-0161: Product uses "char" type for input character. When char is implemented as a signed type, ASCII value 0xFF (255), a sign extension produces a -1 value that is treated as a program-specific separator va
  - CVE-2007-4988: chain: signed short width value in image processor is sign extended during conversion to unsigned int, which leads to integer overflow and heap-based buffer overflow.
  - CVE-2006-1834: chain: signedness error allows bypass of a length check; later sign extension makes exploitation easier.
CWE-195: Signed to Unsigned Conversion Error

Description:
The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

Extended Description:
It is dangerous to rely on implicit casts between signed and unsigned numbers because the result can take on an unexpected value and violate assumptions made by the program. 
             Often, functions will return negative values to indicate a failure. When the result of a function is to be used as a size parameter, using these negative return values can have unexpected results. For example, if negative size values are passed to the standard memory copy or allocation functions they will be implicitly cast to a large unsigned value. This may lead to an exploitable buffer overflow or underflow condition.

Affected languages: C, C++
Parent weaknesses: CWE-681, CWE-681, CWE-681

Consequences:
  - Integrity: Unexpected State

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Demonstrative examples:
In this example the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned int, amount will be implicitly converted to unsigned.
If the error condition in the code above is met, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.
unsigned int readdata () { int amount = 0; ... if (result == ERROR) amount = -1; ... return amount; }

In this example, depending on the return value of accecssmainframe(), the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned value, amount will be implicitly cast to an unsigned number.
If the return value of accessmainframe() is -1, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.
unsigned int readdata () { int amount = 0; ... amount = accessmainframe(); ... return amount; }

Real-world examples:
  - CVE-2025-27363: Font rendering library does not properly
               handle assigning a signed short value to an unsigned
               long (CWE-195), leading to an integer wraparound
               (CWE-190), c
  - CVE-2007-4268: Chain: integer signedness error (CWE-195) passes signed comparison, leading to heap overflow (CWE-122)
CWE-196: Unsigned to Signed Conversion Error

Description:
The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.

Extended Description:
Although less frequent an issue than signed-to-unsigned conversion, unsigned-to-signed conversion can be the perfect precursor to dangerous buffer underwrite conditions that allow attackers to move down the stack where they otherwise might not have access in a normal buffer overflow condition. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.

Affected languages: C, C++
Parent weaknesses: CWE-681, CWE-681, CWE-681

Consequences:
  - Availability: DoS: Crash, Exit, or Restart
  - Integrity: Modify Memory
  - Integrity: Execute Unauthorized Code or Commands

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Requirements] Choose a language which is not subject to these casting flaws.
  - [Architecture and Design] Design object accessor functions to implicitly check values for valid sizes. Ensure that all functions which will be used as a size are checked previous to use as a size. If the language permits, throw exceptions rather than using in-band errors.
  - [Implementation] Error check the return values of all functions. Be aware of implicit casts made, and use unsigned variables for sizes if at all possible.
CWE-198: Use of Incorrect Byte Ordering

Description:
The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-188

Consequences:
  - Integrity: Unexpected State

Detection methods:
  - Black Box: Because byte ordering bugs are usually very noticeable even with normal inputs, this bug is more likely to occur in rarely triggered error conditions, making them difficult to detect using black box m
CWE-201: Insertion of Sensitive Information Into Sent Data

Description:
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-200

Consequences:
  - Confidentiality: Read Files or Directories

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Requirements] Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
  - [Implementation] Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility 
  - [System Configuration] Setup default error messages so that unexpected errors do not disclose sensitive information.
  - [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. 
                   Ensure that appropriate compartm

Demonstrative examples:
The following is an actual MySQL error statement:
The error clearly exposes the database credentials.
Warning: mysql_pconnect(): Access denied for user: 'root@localhost' (Using password: N1nj4) in /usr/local/www/wi-data/includes/database.inc on line 4

Real-world examples:
  - CVE-2023-27265: collaboration platform does not honor a "show email address" setting for a response by an API endpoint
  - CVE-2023-32275: RPC server for a VPN product returns an object that contains heap addresses
  - CVE-2022-0708: Collaboration platform does not clear team emails in a response, allowing leak of email addresses
CWE-202: Exposure of Sensitive Information Through Data Queries

Description:
When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

Extended Description:
In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1230

Consequences:
  - Confidentiality: Read Files or Directories

Mitigations:
  - [Architecture and Design] This is a complex topic. See the [REF-1492] for a good discussion of best practices.

Real-world examples:
  - CVE-2022-41935: Wiki product allows an adversary to discover filenames via a series of queries starting with one letter and then iteratively extending the match.
CWE-204: Observable Response Discrepancy

Description:
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-203

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. 
                   Ensure that appropriate compartm
  - [Implementation] Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal th

Demonstrative examples:
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
In the above code, there are different messages for when an incorrect username is supplied, versus when the username is correct but the password is wrong. This difference enables a potential attacker to understand the state of the login function, and could allow an attacker to discover a valid username by trying different values until the incorrect password message is returned. In essence, this makes it easier for an attacker to obtain half of the necessary authentication credentials.
my $username=param('username');
                   my $password=param('password');
                   
                   if (IsValidUsername($username) == 1)
                   {
  

Real-world examples:
  - CVE-2002-2094: This, and others, use ".." attacks and monitor error responses, so there is overlap with directory traversal.
  - CVE-2001-1483: Enumeration of valid usernames based on inconsistent responses
  - CVE-2001-1528: Account number enumeration via inconsistent responses.
  - CVE-2004-2150: User enumeration via discrepancies in error messages.
  - CVE-2005-1650: User enumeration via discrepancies in error messages.
CWE-205: Observable Behavioral Discrepancy

Description:
The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.

Extended Description:
Ideally, a product should provide as little information about its internal operations as possible.  Otherwise, attackers could use knowledge of these internal operations to simplify or optimize their attack.  In some cases, behavioral discrepancies can be used by attackers to form a side channel.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-203

Consequences:
  - Confidentiality: Read Application Data

Real-world examples:
  - CVE-2002-0208: Product modifies TCP/IP stack and ICMP error messages in unusual ways that show the product is in use.
  - CVE-2004-2252: Behavioral infoleak by responding to SYN-FIN packets.
CWE-206: Observable Internal Behavioral Discrepancy

Description:
The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.

Extended Description:
Ideally, a product should provide as little information as possible to an attacker.  Any hints that the attacker may be making progress can then be used to simplify or optimize the attack.  For example, in a login procedure that requires a username and password, ultimately there is only one decision: success or failure.  However, internally, two separate actions are performed: determining if the username exists, and checking if the password is correct.  If the product behaves differently based on whether the username exists or not, then the attacker only needs to concentrate on the password.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-205

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - Setup generic response pages for error conditions. The error page should not disclose information about the success or failure of a sensitive operation. For instance, the login page should not confirm that the login is correct and the password incorrect. The attacker who tries random account name ma

Real-world examples:
  - CVE-2002-2031: File existence via infoleak monitoring whether "onerror" handler fires or not.
  - CVE-2005-2025: Valid groupname enumeration via behavioral infoleak (sends response if valid, doesn't respond if not).
  - CVE-2001-1497: Behavioral infoleak in GUI allows attackers to distinguish between alphanumeric and non-alphanumeric characters in a password, thus reducing the search space.
  - CVE-2003-0190: Product immediately sends an error message when user does not exist instead of waiting until the password is provided, allowing username enumeration.
CWE-207: Observable Behavioral Discrepancy With Equivalent Products

Description:
The product operates in an environment in which its existence or specific identity should not be known, but it behaves differently than other products with equivalent functionality, in a way that is observable to an attacker.

Extended Description:
For many kinds of products, multiple products may be available that perform the same functionality, such as a web server, network interface, or intrusion detection system.  Attackers often perform "fingerprinting," which uses discrepancies in order to identify which specific product is in use.  Once the specific product has been identified, the attacks can be made more customized and efficient.  Often, an organization might intentionally allow the specific product to be identifiable.  However, in some environments, the ability to identify a distinct product is unacceptable, and it is expected that every product would behave in exactly the same way.  In these more restricted environments, a behavioral difference might pose an unacceptable risk if it makes it easier to identify the product's vendor, model, configuration, version, etc.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-205

Consequences:
  - Confidentiality: Read Application Data

Real-world examples:
  - CVE-2002-0208: Product modifies TCP/IP stack and ICMP error messages in unusual ways that show the product is in use.
  - CVE-2004-2252: Behavioral infoleak by responding to SYN-FIN packets.
  - CVE-2000-1142: Honeypot generates an error with a "pwd" command in a particular directory, allowing attacker to know they are in a honeypot system.
CWE-210: Self-generated Error Message Containing Sensitive Information

Description:
The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-209

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Implementation] Debugging information should not make its way into a production release.
  - [Implementation] Debugging information should not make its way into a production release.

Demonstrative examples:
The following code uses custom configuration files for each user in the application. It checks to see if the file exists on the system before attempting to open and use the file. If the configuration file does not exist, then an error is generated, and the application exits.
If this code is running on a server, such as a web application, then the person making the request should not know what the full pathname of the configuration directory is. By submitting a username that is not associated with a configuration file, an attacker could get this pathname from the error message. It could then be used to exploit path traversal, symbolic link following, or other problems that may exist elsewhere in the application.
$uname = GetUserInput("username"); 
                      
                    

Real-world examples:
  - CVE-2005-1745: Infoleak of sensitive information in error message (physical access required).
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies

Description:
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.

Extended Description:
When handling information, the developer must consider whether the information is regarded as sensitive by different stakeholders, such as users or administrators.  Each stakeholder effectively has its own intended security policy that the product is expected to uphold.  When a developer does not treat that information as sensitive, this can introduce a vulnerability that violates the expectations of the product's users.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-200

Consequences:
  - Confidentiality: Read Application Data

Demonstrative examples:
This code displays some information on a web page.
The code displays a user's credit card and social security numbers, even though they aren't absolutely necessary.
Social Security Number: <%= ssn %></br>Credit Card Number: <%= ccn %>

Real-world examples:
  - CVE-2002-1725: Script calls phpinfo()
  - CVE-2004-0033: Script calls phpinfo()
  - CVE-2003-1181: Script calls phpinfo()
  - CVE-2004-1422: Script calls phpinfo()
  - CVE-2004-1590: Script calls phpinfo()