deardaniel/secdata-raw huggingface dataset:
CWE-791: Incomplete Filtering of Special Elements

Description:
The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-790

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
The following code takes untrusted input and uses a regular expression to filter "../" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Since the regular expression does not have the /g global match modifier, it only removes the first instance of "../" it comes across. So an input value such as:
my $Username = GetUntrustedInput(); $Username =~ s/\.\.\///; my $filename = "/home/user/" . $Username; ReadAndSendFile($filename);
../../../etc/passwd
CWE-792: Incomplete Filtering of One or More Instances of Special Elements

Description:
The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.

Extended Description:
Incomplete filtering of this nature involves either: 
                
                   only filtering a single instance of a special element when more exist, or 
                   not filtering all instances or all elements where multiple special elements exist.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-791

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
The following code takes untrusted input and uses a regular expression to filter "../" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Since the regular expression does not have the /g global match modifier, it only removes the first instance of "../" it comes across. So an input value such as:
my $Username = GetUntrustedInput(); $Username =~ s/\.\.\///; my $filename = "/home/user/" . $Username; ReadAndSendFile($filename);
../../../etc/passwd
CWE-793: Only Filtering One Instance of a Special Element

Description:
The product receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component.

Extended Description:
Incomplete filtering of this nature may be location-dependent, as in only the first or last element is filtered.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-792

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
The following code takes untrusted input and uses a regular expression to filter "../" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Since the regular expression does not have the /g global match modifier, it only removes the first instance of "../" it comes across. So an input value such as:
my $Username = GetUntrustedInput(); $Username =~ s/\.\.\///; my $filename = "/home/user/" . $Username; ReadAndSendFile($filename);
../../../etc/passwd
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements

Description:
The product receives data from an upstream component, but does not filter all instances of a special element before sending it to a downstream component.

Extended Description:
Incomplete filtering of this nature may be applied to: 
                
                   sequential elements (special elements that appear next to each other) or 
                   non-sequential elements (special elements that appear multiple times in different locations).

Affected languages: Not Language-Specific
Parent weaknesses: CWE-792

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
The following code takes untrusted input and uses a regular expression to filter "../" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Since the regular expression does not have the /g global match modifier, it only removes the first instance of "../" it comes across. So an input value such as:
my $Username = GetUntrustedInput(); $Username =~ s/\.\.\///; my $filename = "/home/user/" . $Username; ReadAndSendFile($filename);
../../../etc/passwd
CWE-795: Only Filtering Special Elements at a Specified Location

Description:
The product receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component.

Extended Description:
A filter might only account for instances of special elements when they occur: 
                
                   relative to a marker (e.g. "at the beginning/end of string; the second argument"), or 
                   at an absolute position (e.g. "byte number 10"). 
                
             This may leave special elements in the data that did not match the filter position, but still may be dangerous.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-791

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
The following code takes untrusted input and uses a regular expression to filter a "../" element located at the beginning of the input string. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Since the regular expression is only looking for an instance of "../" at the beginning of the string, it only removes the first "../" element. So an input value such as:
my $Username = GetUntrustedInput(); $Username =~ s/^\.\.\///; my $filename = "/home/user/" . $Username; ReadAndSendFile($filename);
../../../etc/passwd

The following code takes untrusted input and uses a substring function to filter a 3-character "../" element located at the 0-index position of the input string. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Since the if function is only looking for a substring of "../" between the 0 and 2 position, it only removes that specific "../" element. So an input value such as:
my $Username = GetUntrustedInput(); if (substr($Username, 0, 3) eq '../') { $Username = substr($Username, 3); } my $filename = "/home/user/" . $Username; ReadAndSendFile($filename);
../../../etc/passwd
CWE-796: Only Filtering Special Elements Relative to a Marker

Description:
The product receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. "at the beginning/end of a string; the second argument"), thereby missing remaining special elements that may exist before sending it to a downstream component.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-795

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
The following code takes untrusted input and uses a regular expression to filter a "../" element located at the beginning of the input string. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Since the regular expression is only looking for an instance of "../" at the beginning of the string, it only removes the first "../" element. So an input value such as:
my $Username = GetUntrustedInput(); $Username =~ s/^\.\.\///; my $filename = "/home/user/" . $Username; ReadAndSendFile($filename);
../../../etc/passwd
CWE-797: Only Filtering Special Elements at an Absolute Position

Description:
The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. "byte number 10"), thereby missing remaining special elements that may exist before sending it to a downstream component.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-795

Consequences:
  - Integrity: Unexpected State

Demonstrative examples:
The following code takes untrusted input and uses a substring function to filter a 3-character "../" element located at the 0-index position of the input string. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Since the if function is only looking for a substring of "../" between the 0 and 2 position, it only removes that specific "../" element. So an input value such as:
my $Username = GetUntrustedInput(); if (substr($Username, 0, 3) eq '../') { $Username = substr($Username, 3); } my $filename = "/home/user/" . $Username; ReadAndSendFile($filename);
../../../etc/passwd
CWE-799: Improper Control of Interaction Frequency

Description:
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

Extended Description:
This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic (such as limiting humans to a single vote), or other consequences. For example, an authentication routine might not limit the number of times an attacker can guess a password. Or, a web site might conduct a poll but only expect humans to vote a maximum of once a day.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based, Web Server
Parent weaknesses: CWE-691

Consequences:
  - Availability: DoS: Resource Consumption (Other)

Demonstrative examples:
In the following code a username and password is read from a socket and an attempt is made to authenticate the username and password. The code will continuously checked the socket for a username and password until it has been authenticated.
This code does not place any restriction on the number of authentication attempts made. There should be a limit on the number of authentication attempts made to prevent brute force attacks as in the following example code.
char username[USERNAME_SIZE]; char password[PASSWORD_SIZE]; 
                      while (isValidUser == 0) { 
                         if (getNextMessage(socket, username, USERNAME_SIZE) > 0) { if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) { isValidUser = AuthenticateUser(username, password); } } 
                      } r

Real-world examples:
  - CVE-2024-50653: Chain: e-commerce product has a "front-end restriction" for coupon use (CWE-602), but the server does not restrict the number of requests for the same coupon (CWE-799)
  - CVE-2002-1876: Mail server allows attackers to prevent other users from accessing mail by sending large number of rapid requests.
CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote

Description:
When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the bean's data. These methods could be leveraged to read sensitive information, or to change data in ways that violate the application's expectations, potentially leading to other vulnerabilities.

Affected languages: Java
Parent weaknesses: CWE-668

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Implementation] Declare Java beans "local" when possible. When a bean must be remotely accessible, make sure that sensitive information is not exposed, and ensure that the application logic performs appropriate validation of any data that might be modified by an attacker.

Demonstrative examples:
The following example demonstrates the weakness.

<ejb-jar> <enterprise-beans> <entity> <ejb-name>EmployeeRecord</ejb-name> <home>com.wombat.empl.EmployeeRecordHome</home> <remote>com.wombat.empl.EmployeeRecord</remote> ... </entity> ... </enterprise-beans> </ejb-jar>
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Description:
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-79

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Carefully check each input parameter against a rigorous positive specification (allowlist) defining the specific characters and format allowed. All input should be neutralized, not just parameters that the user is supposed to specify, but all data in the request, including hidden fields, cookies, he
  - [Implementation] Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or au
  - [Implementation] With Struts, write all data from form beans with the bean's filter attribute set to true.
  - [Implementation] To help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible to maliciou

Demonstrative examples:
In the following example, a guestbook comment isn't properly encoded, filtered, or otherwise neutralized for script-related tags before being displayed in a client browser.

<% for (Iterator i = guestbook.iterator(); i.hasNext(); ) { Entry e = (Entry) i.next(); %> <p>Entry #<%= e.getId() %></p> <p><%= e.getText() %></p> <% } %>

Real-world examples:
  - CVE-2002-0938: XSS in parameter in a link.
  - CVE-2002-1495: XSS in web-based email product via attachment filenames.
  - CVE-2003-1136: HTML injection in posted message.
  - CVE-2004-2171: XSS not quoted in error page.
CWE-804: Guessable CAPTCHA

Description:
The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.

Extended Description:
An automated attacker could bypass the intended protection of the CAPTCHA challenge and perform actions at a higher frequency than humanly possible, such as launching spam attacks. 
             There can be several different causes of a guessable CAPTCHA: 
                
                   An audio or visual image that does not have sufficient distortion from the unobfuscated source image. 
                   A question is generated with a format that can be automatically recognized, such as a math question. 
                   A question for which the number of possible answers is limited, such as birth years or favorite sports teams. 
                   A general-knowledge or trivia question for which the answer can be accessed using a data base, such as country capitals or popular entertainers. 
                   Other data associated with the CAPTCHA may provide hints about its contents, such as an image whose filename contains the word that is used in the CAPTCHA.

Affected languages: Not Language-Specific
Affected technologies: Web Server
Parent weaknesses: CWE-863, CWE-1390

Consequences:
  - Access Control: Bypass Protection Mechanism

Real-world examples:
  - CVE-2022-4036: Chain: appointment booking app uses a weak hash (CWE-328) for generating a CAPTCHA, making it guessable  (CWE-804)
CWE-81: Improper Neutralization of Script in an Error Message Web Page

Description:
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scripting elements when they are sent to an error page.

Extended Description:
Error pages may include customized 403 Forbidden or 404 Not Found pages. 
             When an attacker can trigger an error that contains script syntax within the attacker's input, then cross-site scripting attacks may be possible.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-79

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Do not write user-controlled input to error pages.
  - [Implementation] Carefully check each input parameter against a rigorous positive specification (allowlist) defining the specific characters and format allowed. All input should be neutralized, not just parameters that the user is supposed to specify, but all data in the request, including hidden fields, cookies, he
  - [Implementation] Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or au
  - [Implementation] With Struts, write all data from form beans with the bean's filter attribute set to true.

Real-world examples:
  - CVE-2002-0840: XSS in default error page from Host: header.
  - CVE-2002-1053: XSS in error message.
  - CVE-2002-1700: XSS in error page from targeted parameter.
CWE-82: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Description:
The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

Extended Description:
Attackers can embed XSS exploits into the values for IMG attributes (e.g. SRC) that is streamed and then executed in a victim's browser. Note that when the page is loaded into a user's browsers, the exploit will automatically execute.

Affected languages: Not Language-Specific
Affected technologies: Web Based, Web Server
Parent weaknesses: CWE-83

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [Implementation] Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or au
  - [Implementation] To help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible to maliciou

Real-world examples:
  - CVE-2006-3211: Stored XSS in a guestbook application using a javascript: URI in a bbcode img tag.
  - CVE-2002-1649: javascript URI scheme in IMG tag.
  - CVE-2002-1803: javascript URI scheme in IMG tag.
  - CVE-2002-1804: javascript URI scheme in IMG tag.
  - CVE-2002-1805: javascript URI scheme in IMG tag.
CWE-820: Missing Synchronization

Description:
The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

Extended Description:
If access to a shared resource is not synchronized, then the resource may not be in a state that is expected by the product. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-662, CWE-662, CWE-662

Consequences:
  - Integrity: Modify Application Data

Demonstrative examples:
The following code intends to fork a process, then have both the parent and child processes print a single line.
One might expect the code to print out something like:
static void print (char * string) { 
                         char * word; int counter; for (word = string; counter = *word++; ) { 
                               putc(counter, stdout); fflush(stdout); 
                                  /* Make timing window a little larger... */ 
                                  
                                  sleep(1); 
                            } 
                      } 
                      int main(void) { 
                         pid_t pid; 
                            pid = fork(); if (pid == -1) { exit(-2); } else if (pid == 0) { print("child\n"); } else { print("PARENT\n");
CWE-821: Incorrect Synchronization

Description:
The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.

Extended Description:
If access to a shared resource is not correctly synchronized, then the resource may not be in a state that is expected by the product. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-662, CWE-662, CWE-662

Consequences:
  - Integrity: Modify Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
CWE-822: Untrusted Pointer Dereference

Description:
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

Extended Description:
An attacker can supply a pointer for memory locations that the product is not expecting. If the pointer is dereferenced for a write operation, the attack might allow modification of critical state variables, cause a crash, or execute code. If the dereferencing operation is for a read, then the attack might allow reading of sensitive data, cause a crash, or set a variable to an unexpected value (since the value will be read from an unexpected memory location). 
             There are several variants of this weakness, including but not necessarily limited to: 
                
                   The untrusted value is directly invoked as a function call. 
                   In OS kernels or drivers where there is a boundary between "userland" and privileged memory spaces, an untrusted pointer might enter through an API or system call (see CWE-781 for one such example). 
                   Inadvertently accepting the value from an untrusted control sphere when it did not have to be accep

Affected languages: Memory-Unsafe, C, C++
Parent weaknesses: CWE-119, CWE-119, CWE-119

Consequences:
  - Confidentiality: Read Memory
  - Availability: DoS: Crash, Exit, or Restart
  - Integrity: Execute Unauthorized Code or Commands

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
  - Automated Dynamic Analysis: Use tools that are integrated during
	     compilation to insert runtime error-checking mechanisms
	     related to memory safety errors, such as AddressSanitizer
	     (ASan) for C/C++ [REF-1518].

Real-world examples:
  - CVE-2007-5655: message-passing framework interprets values in packets as pointers, causing a crash.
  - CVE-2010-2299: labeled as a "type confusion" issue, also referred to as a "stale pointer." However, the bug ID says "contents are simply interpreted as a pointer... renderer ordinarily doesn't supply this pointer di
  - CVE-2009-1719: Untrusted dereference using undocumented constructor.
  - CVE-2009-1250: An error code is incorrectly checked and interpreted as a pointer, leading to a crash.
  - CVE-2009-0311: An untrusted value is obtained from a packet and directly called as a function pointer, leading to code execution.