| { |
| "architectures": [ |
| "ModernBertModel" |
| ], |
| "attention_bias": false, |
| "attention_dropout": 0.0, |
| "bos_token_id": 50281, |
| "classifier_activation": "gelu", |
| "classifier_bias": false, |
| "classifier_dropout": 0.0, |
| "classifier_pooling": "mean", |
| "cls_token_id": 50281, |
| "cvss_map": { |
| "attack_complexity": [ |
| "Low", |
| "High" |
| ], |
| "attack_vector": [ |
| "Network", |
| "Adjacent", |
| "Local", |
| "Physical" |
| ], |
| "availability": [ |
| "None", |
| "Low", |
| "High" |
| ], |
| "confidentiality": [ |
| "None", |
| "Low", |
| "High" |
| ], |
| "integrity": [ |
| "None", |
| "Low", |
| "High" |
| ], |
| "privileges_required": [ |
| "None", |
| "Low", |
| "High" |
| ], |
| "scope": [ |
| "Changed", |
| "Unchanged" |
| ], |
| "user_interaction": [ |
| "None", |
| "Required" |
| ] |
| }, |
| "cwe_labels": { |
| "base": [ |
| { |
| "id": "15", |
| "name": "External Control of System or Configuration Setting" |
| }, |
| { |
| "id": "22", |
| "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" |
| }, |
| { |
| "id": "23", |
| "name": "Relative Path Traversal" |
| }, |
| { |
| "id": "36", |
| "name": "Absolute Path Traversal" |
| }, |
| { |
| "id": "41", |
| "name": "Improper Resolution of Path Equivalence" |
| }, |
| { |
| "id": "59", |
| "name": "Improper Link Resolution Before File Access ('Link Following')" |
| }, |
| { |
| "id": "61", |
| "name": "UNIX Symbolic Link (Symlink) Following" |
| }, |
| { |
| "id": "66", |
| "name": "Improper Handling of File Names that Identify Virtual Resources" |
| }, |
| { |
| "id": "73", |
| "name": "External Control of File Name or Path" |
| }, |
| { |
| "id": "76", |
| "name": "Improper Neutralization of Equivalent Special Elements" |
| }, |
| { |
| "id": "78", |
| "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" |
| }, |
| { |
| "id": "79", |
| "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" |
| }, |
| { |
| "id": "88", |
| "name": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" |
| }, |
| { |
| "id": "89", |
| "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" |
| }, |
| { |
| "id": "90", |
| "name": "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')" |
| }, |
| { |
| "id": "91", |
| "name": "XML Injection (aka Blind XPath Injection)" |
| }, |
| { |
| "id": "93", |
| "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" |
| }, |
| { |
| "id": "94", |
| "name": "Improper Control of Generation of Code ('Code Injection')" |
| }, |
| { |
| "id": "96", |
| "name": "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')" |
| }, |
| { |
| "id": "112", |
| "name": "Missing XML Validation" |
| }, |
| { |
| "id": "115", |
| "name": "Misinterpretation of Input" |
| }, |
| { |
| "id": "117", |
| "name": "Improper Output Neutralization for Logs" |
| }, |
| { |
| "id": "120", |
| "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" |
| }, |
| { |
| "id": "123", |
| "name": "Write-what-where Condition" |
| }, |
| { |
| "id": "124", |
| "name": "Buffer Underwrite ('Buffer Underflow')" |
| }, |
| { |
| "id": "125", |
| "name": "Out-of-bounds Read" |
| }, |
| { |
| "id": "128", |
| "name": "Wrap-around Error" |
| }, |
| { |
| "id": "130", |
| "name": "Improper Handling of Length Parameter Inconsistency" |
| }, |
| { |
| "id": "131", |
| "name": "Incorrect Calculation of Buffer Size" |
| }, |
| { |
| "id": "134", |
| "name": "Use of Externally-Controlled Format String" |
| }, |
| { |
| "id": "135", |
| "name": "Incorrect Calculation of Multi-Byte String Length" |
| }, |
| { |
| "id": "140", |
| "name": "Improper Neutralization of Delimiters" |
| }, |
| { |
| "id": "166", |
| "name": "Improper Handling of Missing Special Element" |
| }, |
| { |
| "id": "167", |
| "name": "Improper Handling of Additional Special Element" |
| }, |
| { |
| "id": "168", |
| "name": "Improper Handling of Inconsistent Special Elements" |
| }, |
| { |
| "id": "170", |
| "name": "Improper Null Termination" |
| }, |
| { |
| "id": "178", |
| "name": "Improper Handling of Case Sensitivity" |
| }, |
| { |
| "id": "179", |
| "name": "Incorrect Behavior Order: Early Validation" |
| }, |
| { |
| "id": "182", |
| "name": "Collapse of Data into Unsafe Value" |
| }, |
| { |
| "id": "183", |
| "name": "Permissive List of Allowed Inputs" |
| }, |
| { |
| "id": "184", |
| "name": "Incomplete List of Disallowed Inputs" |
| }, |
| { |
| "id": "186", |
| "name": "Overly Restrictive Regular Expression" |
| }, |
| { |
| "id": "188", |
| "name": "Reliance on Data/Memory Layout" |
| }, |
| { |
| "id": "190", |
| "name": "Integer Overflow or Wraparound" |
| }, |
| { |
| "id": "191", |
| "name": "Integer Underflow (Wrap or Wraparound)" |
| }, |
| { |
| "id": "193", |
| "name": "Off-by-one Error" |
| }, |
| { |
| "id": "197", |
| "name": "Numeric Truncation Error" |
| }, |
| { |
| "id": "201", |
| "name": "Insertion of Sensitive Information Into Sent Data" |
| }, |
| { |
| "id": "202", |
| "name": "Exposure of Sensitive Information Through Data Queries" |
| }, |
| { |
| "id": "203", |
| "name": "Observable Discrepancy" |
| }, |
| { |
| "id": "204", |
| "name": "Observable Response Discrepancy" |
| }, |
| { |
| "id": "205", |
| "name": "Observable Behavioral Discrepancy" |
| }, |
| { |
| "id": "208", |
| "name": "Observable Timing Discrepancy" |
| }, |
| { |
| "id": "209", |
| "name": "Generation of Error Message Containing Sensitive Information" |
| }, |
| { |
| "id": "210", |
| "name": "Self-generated Error Message Containing Sensitive Information" |
| }, |
| { |
| "id": "211", |
| "name": "Externally-Generated Error Message Containing Sensitive Information" |
| }, |
| { |
| "id": "212", |
| "name": "Improper Removal of Sensitive Information Before Storage or Transfer" |
| }, |
| { |
| "id": "213", |
| "name": "Exposure of Sensitive Information Due to Incompatible Policies" |
| }, |
| { |
| "id": "214", |
| "name": "Invocation of Process Using Visible Sensitive Information" |
| }, |
| { |
| "id": "215", |
| "name": "Insertion of Sensitive Information Into Debugging Code" |
| }, |
| { |
| "id": "222", |
| "name": "Truncation of Security-relevant Information" |
| }, |
| { |
| "id": "223", |
| "name": "Omission of Security-relevant Information" |
| }, |
| { |
| "id": "224", |
| "name": "Obscured Security-relevant Information by Alternate Name" |
| }, |
| { |
| "id": "226", |
| "name": "Sensitive Information in Resource Not Removed Before Reuse" |
| }, |
| { |
| "id": "229", |
| "name": "Improper Handling of Values" |
| }, |
| { |
| "id": "233", |
| "name": "Improper Handling of Parameters" |
| }, |
| { |
| "id": "237", |
| "name": "Improper Handling of Structural Elements" |
| }, |
| { |
| "id": "240", |
| "name": "Improper Handling of Inconsistent Structural Elements" |
| }, |
| { |
| "id": "241", |
| "name": "Improper Handling of Unexpected Data Type" |
| }, |
| { |
| "id": "242", |
| "name": "Use of Inherently Dangerous Function" |
| }, |
| { |
| "id": "248", |
| "name": "Uncaught Exception" |
| }, |
| { |
| "id": "250", |
| "name": "Execution with Unnecessary Privileges" |
| }, |
| { |
| "id": "252", |
| "name": "Unchecked Return Value" |
| }, |
| { |
| "id": "253", |
| "name": "Incorrect Check of Function Return Value" |
| }, |
| { |
| "id": "256", |
| "name": "Plaintext Storage of a Password" |
| }, |
| { |
| "id": "257", |
| "name": "Storing Passwords in a Recoverable Format" |
| }, |
| { |
| "id": "260", |
| "name": "Password in Configuration File" |
| }, |
| { |
| "id": "261", |
| "name": "Weak Encoding for Password" |
| }, |
| { |
| "id": "262", |
| "name": "Not Using Password Aging" |
| }, |
| { |
| "id": "263", |
| "name": "Password Aging with Long Expiration" |
| }, |
| { |
| "id": "266", |
| "name": "Incorrect Privilege Assignment" |
| }, |
| { |
| "id": "267", |
| "name": "Privilege Defined With Unsafe Actions" |
| }, |
| { |
| "id": "268", |
| "name": "Privilege Chaining" |
| }, |
| { |
| "id": "270", |
| "name": "Privilege Context Switching Error" |
| }, |
| { |
| "id": "272", |
| "name": "Least Privilege Violation" |
| }, |
| { |
| "id": "273", |
| "name": "Improper Check for Dropped Privileges" |
| }, |
| { |
| "id": "274", |
| "name": "Improper Handling of Insufficient Privileges" |
| }, |
| { |
| "id": "276", |
| "name": "Incorrect Default Permissions" |
| }, |
| { |
| "id": "280", |
| "name": "Improper Handling of Insufficient Permissions or Privileges " |
| }, |
| { |
| "id": "281", |
| "name": "Improper Preservation of Permissions" |
| }, |
| { |
| "id": "283", |
| "name": "Unverified Ownership" |
| }, |
| { |
| "id": "288", |
| "name": "Authentication Bypass Using an Alternate Path or Channel" |
| }, |
| { |
| "id": "289", |
| "name": "Authentication Bypass by Alternate Name" |
| }, |
| { |
| "id": "290", |
| "name": "Authentication Bypass by Spoofing" |
| }, |
| { |
| "id": "294", |
| "name": "Authentication Bypass by Capture-replay" |
| }, |
| { |
| "id": "295", |
| "name": "Improper Certificate Validation" |
| }, |
| { |
| "id": "296", |
| "name": "Improper Following of a Certificate's Chain of Trust" |
| }, |
| { |
| "id": "299", |
| "name": "Improper Check for Certificate Revocation" |
| }, |
| { |
| "id": "301", |
| "name": "Reflection Attack in an Authentication Protocol" |
| }, |
| { |
| "id": "302", |
| "name": "Authentication Bypass by Assumed-Immutable Data" |
| }, |
| { |
| "id": "303", |
| "name": "Incorrect Implementation of Authentication Algorithm" |
| }, |
| { |
| "id": "304", |
| "name": "Missing Critical Step in Authentication" |
| }, |
| { |
| "id": "305", |
| "name": "Authentication Bypass by Primary Weakness" |
| }, |
| { |
| "id": "306", |
| "name": "Missing Authentication for Critical Function" |
| }, |
| { |
| "id": "307", |
| "name": "Improper Restriction of Excessive Authentication Attempts" |
| }, |
| { |
| "id": "308", |
| "name": "Use of Single-factor Authentication" |
| }, |
| { |
| "id": "309", |
| "name": "Use of Password System for Primary Authentication" |
| }, |
| { |
| "id": "312", |
| "name": "Cleartext Storage of Sensitive Information" |
| }, |
| { |
| "id": "319", |
| "name": "Cleartext Transmission of Sensitive Information" |
| }, |
| { |
| "id": "322", |
| "name": "Key Exchange without Entity Authentication" |
| }, |
| { |
| "id": "323", |
| "name": "Reusing a Nonce, Key Pair in Encryption" |
| }, |
| { |
| "id": "324", |
| "name": "Use of a Key Past its Expiration Date" |
| }, |
| { |
| "id": "325", |
| "name": "Missing Cryptographic Step" |
| }, |
| { |
| "id": "328", |
| "name": "Use of Weak Hash" |
| }, |
| { |
| "id": "331", |
| "name": "Insufficient Entropy" |
| }, |
| { |
| "id": "334", |
| "name": "Small Space of Random Values" |
| }, |
| { |
| "id": "335", |
| "name": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)" |
| }, |
| { |
| "id": "338", |
| "name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)" |
| }, |
| { |
| "id": "341", |
| "name": "Predictable from Observable State" |
| }, |
| { |
| "id": "342", |
| "name": "Predictable Exact Value from Previous Values" |
| }, |
| { |
| "id": "343", |
| "name": "Predictable Value Range from Previous Values" |
| }, |
| { |
| "id": "344", |
| "name": "Use of Invariant Value in Dynamically Changing Context" |
| }, |
| { |
| "id": "347", |
| "name": "Improper Verification of Cryptographic Signature" |
| }, |
| { |
| "id": "348", |
| "name": "Use of Less Trusted Source" |
| }, |
| { |
| "id": "349", |
| "name": "Acceptance of Extraneous Untrusted Data With Trusted Data" |
| }, |
| { |
| "id": "351", |
| "name": "Insufficient Type Distinction" |
| }, |
| { |
| "id": "352", |
| "name": "Cross-Site Request Forgery (CSRF)" |
| }, |
| { |
| "id": "353", |
| "name": "Missing Support for Integrity Check" |
| }, |
| { |
| "id": "354", |
| "name": "Improper Validation of Integrity Check Value" |
| }, |
| { |
| "id": "356", |
| "name": "Product UI does not Warn User of Unsafe Actions" |
| }, |
| { |
| "id": "357", |
| "name": "Insufficient UI Warning of Dangerous Operations" |
| }, |
| { |
| "id": "358", |
| "name": "Improperly Implemented Security Check for Standard" |
| }, |
| { |
| "id": "359", |
| "name": "Exposure of Private Personal Information to an Unauthorized Actor" |
| }, |
| { |
| "id": "360", |
| "name": "Trust of System Event Data" |
| }, |
| { |
| "id": "363", |
| "name": "Race Condition Enabling Link Following" |
| }, |
| { |
| "id": "364", |
| "name": "Signal Handler Race Condition" |
| }, |
| { |
| "id": "366", |
| "name": "Race Condition within a Thread" |
| }, |
| { |
| "id": "367", |
| "name": "Time-of-check Time-of-use (TOCTOU) Race Condition" |
| }, |
| { |
| "id": "368", |
| "name": "Context Switching Race Condition" |
| }, |
| { |
| "id": "369", |
| "name": "Divide By Zero" |
| }, |
| { |
| "id": "372", |
| "name": "Incomplete Internal State Distinction" |
| }, |
| { |
| "id": "374", |
| "name": "Passing Mutable Objects to an Untrusted Method" |
| }, |
| { |
| "id": "375", |
| "name": "Returning a Mutable Object to an Untrusted Caller" |
| }, |
| { |
| "id": "378", |
| "name": "Creation of Temporary File With Insecure Permissions" |
| }, |
| { |
| "id": "379", |
| "name": "Creation of Temporary File in Directory with Insecure Permissions" |
| }, |
| { |
| "id": "384", |
| "name": "Session Fixation" |
| }, |
| { |
| "id": "385", |
| "name": "Covert Timing Channel" |
| }, |
| { |
| "id": "386", |
| "name": "Symbolic Name not Mapping to Correct Object" |
| }, |
| { |
| "id": "390", |
| "name": "Detection of Error Condition Without Action" |
| }, |
| { |
| "id": "391", |
| "name": "Unchecked Error Condition" |
| }, |
| { |
| "id": "392", |
| "name": "Missing Report of Error Condition" |
| }, |
| { |
| "id": "393", |
| "name": "Return of Wrong Status Code" |
| }, |
| { |
| "id": "394", |
| "name": "Unexpected Status Code or Return Value" |
| }, |
| { |
| "id": "395", |
| "name": "Use of NullPointerException Catch to Detect NULL Pointer Dereference" |
| }, |
| { |
| "id": "396", |
| "name": "Declaration of Catch for Generic Exception" |
| }, |
| { |
| "id": "397", |
| "name": "Declaration of Throws for Generic Exception" |
| }, |
| { |
| "id": "403", |
| "name": "Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')" |
| }, |
| { |
| "id": "408", |
| "name": "Incorrect Behavior Order: Early Amplification" |
| }, |
| { |
| "id": "409", |
| "name": "Improper Handling of Highly Compressed Data (Data Amplification)" |
| }, |
| { |
| "id": "412", |
| "name": "Unrestricted Externally Accessible Lock" |
| }, |
| { |
| "id": "413", |
| "name": "Improper Resource Locking" |
| }, |
| { |
| "id": "414", |
| "name": "Missing Lock Check" |
| }, |
| { |
| "id": "419", |
| "name": "Unprotected Primary Channel" |
| }, |
| { |
| "id": "420", |
| "name": "Unprotected Alternate Channel" |
| }, |
| { |
| "id": "421", |
| "name": "Race Condition During Access to Alternate Channel" |
| }, |
| { |
| "id": "425", |
| "name": "Direct Request ('Forced Browsing')" |
| }, |
| { |
| "id": "426", |
| "name": "Untrusted Search Path" |
| }, |
| { |
| "id": "427", |
| "name": "Uncontrolled Search Path Element" |
| }, |
| { |
| "id": "428", |
| "name": "Unquoted Search Path or Element" |
| }, |
| { |
| "id": "430", |
| "name": "Deployment of Wrong Handler" |
| }, |
| { |
| "id": "431", |
| "name": "Missing Handler" |
| }, |
| { |
| "id": "432", |
| "name": "Dangerous Signal Handler not Disabled During Sensitive Operations" |
| }, |
| { |
| "id": "434", |
| "name": "Unrestricted Upload of File with Dangerous Type" |
| }, |
| { |
| "id": "437", |
| "name": "Incomplete Model of Endpoint Features" |
| }, |
| { |
| "id": "439", |
| "name": "Behavioral Change in New Version or Environment" |
| }, |
| { |
| "id": "440", |
| "name": "Expected Behavior Violation" |
| }, |
| { |
| "id": "444", |
| "name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')" |
| }, |
| { |
| "id": "447", |
| "name": "Unimplemented or Unsupported Feature in UI" |
| }, |
| { |
| "id": "448", |
| "name": "Obsolete Feature in UI" |
| }, |
| { |
| "id": "449", |
| "name": "The UI Performs the Wrong Action" |
| }, |
| { |
| "id": "450", |
| "name": "Multiple Interpretations of UI Input" |
| }, |
| { |
| "id": "454", |
| "name": "External Initialization of Trusted Variables or Data Stores" |
| }, |
| { |
| "id": "455", |
| "name": "Non-exit on Failed Initialization" |
| }, |
| { |
| "id": "459", |
| "name": "Incomplete Cleanup" |
| }, |
| { |
| "id": "460", |
| "name": "Improper Cleanup on Thrown Exception" |
| }, |
| { |
| "id": "463", |
| "name": "Deletion of Data Structure Sentinel" |
| }, |
| { |
| "id": "464", |
| "name": "Addition of Data Structure Sentinel" |
| }, |
| { |
| "id": "466", |
| "name": "Return of Pointer Value Outside of Expected Range" |
| }, |
| { |
| "id": "468", |
| "name": "Incorrect Pointer Scaling" |
| }, |
| { |
| "id": "469", |
| "name": "Use of Pointer Subtraction to Determine Size" |
| }, |
| { |
| "id": "470", |
| "name": "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')" |
| }, |
| { |
| "id": "471", |
| "name": "Modification of Assumed-Immutable Data (MAID)" |
| }, |
| { |
| "id": "472", |
| "name": "External Control of Assumed-Immutable Web Parameter" |
| }, |
| { |
| "id": "474", |
| "name": "Use of Function with Inconsistent Implementations" |
| }, |
| { |
| "id": "475", |
| "name": "Undefined Behavior for Input to API" |
| }, |
| { |
| "id": "476", |
| "name": "NULL Pointer Dereference" |
| }, |
| { |
| "id": "477", |
| "name": "Use of Obsolete Function" |
| }, |
| { |
| "id": "478", |
| "name": "Missing Default Case in Multiple Condition Expression" |
| }, |
| { |
| "id": "480", |
| "name": "Use of Incorrect Operator" |
| }, |
| { |
| "id": "483", |
| "name": "Incorrect Block Delimitation" |
| }, |
| { |
| "id": "484", |
| "name": "Omitted Break Statement in Switch" |
| }, |
| { |
| "id": "487", |
| "name": "Reliance on Package-level Scope" |
| }, |
| { |
| "id": "488", |
| "name": "Exposure of Data Element to Wrong Session" |
| }, |
| { |
| "id": "489", |
| "name": "Active Debug Code" |
| }, |
| { |
| "id": "494", |
| "name": "Download of Code Without Integrity Check" |
| }, |
| { |
| "id": "497", |
| "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere" |
| }, |
| { |
| "id": "501", |
| "name": "Trust Boundary Violation" |
| }, |
| { |
| "id": "502", |
| "name": "Deserialization of Untrusted Data" |
| }, |
| { |
| "id": "507", |
| "name": "Trojan Horse" |
| }, |
| { |
| "id": "508", |
| "name": "Non-Replicating Malicious Code" |
| }, |
| { |
| "id": "509", |
| "name": "Replicating Malicious Code (Virus or Worm)" |
| }, |
| { |
| "id": "510", |
| "name": "Trapdoor" |
| }, |
| { |
| "id": "511", |
| "name": "Logic/Time Bomb" |
| }, |
| { |
| "id": "512", |
| "name": "Spyware" |
| }, |
| { |
| "id": "515", |
| "name": "Covert Storage Channel" |
| }, |
| { |
| "id": "521", |
| "name": "Weak Password Requirements" |
| }, |
| { |
| "id": "523", |
| "name": "Unprotected Transport of Credentials" |
| }, |
| { |
| "id": "524", |
| "name": "Use of Cache Containing Sensitive Information" |
| }, |
| { |
| "id": "532", |
| "name": "Insertion of Sensitive Information into Log File" |
| }, |
| { |
| "id": "538", |
| "name": "Insertion of Sensitive Information into Externally-Accessible File or Directory" |
| }, |
| { |
| "id": "540", |
| "name": "Inclusion of Sensitive Information in Source Code" |
| }, |
| { |
| "id": "544", |
| "name": "Missing Standardized Error Handling Mechanism" |
| }, |
| { |
| "id": "547", |
| "name": "Use of Hard-coded, Security-relevant Constants" |
| }, |
| { |
| "id": "549", |
| "name": "Missing Password Field Masking" |
| }, |
| { |
| "id": "551", |
| "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization" |
| }, |
| { |
| "id": "552", |
| "name": "Files or Directories Accessible to External Parties" |
| }, |
| { |
| "id": "561", |
| "name": "Dead Code" |
| }, |
| { |
| "id": "562", |
| "name": "Return of Stack Variable Address" |
| }, |
| { |
| "id": "563", |
| "name": "Assignment to Variable without Use" |
| }, |
| { |
| "id": "565", |
| "name": "Reliance on Cookies without Validation and Integrity Checking" |
| }, |
| { |
| "id": "567", |
| "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" |
| }, |
| { |
| "id": "570", |
| "name": "Expression is Always False" |
| }, |
| { |
| "id": "571", |
| "name": "Expression is Always True" |
| }, |
| { |
| "id": "584", |
| "name": "Return Inside Finally Block" |
| }, |
| { |
| "id": "586", |
| "name": "Explicit Call to Finalize()" |
| }, |
| { |
| "id": "601", |
| "name": "URL Redirection to Untrusted Site ('Open Redirect')" |
| }, |
| { |
| "id": "603", |
| "name": "Use of Client-Side Authentication" |
| }, |
| { |
| "id": "606", |
| "name": "Unchecked Input for Loop Condition" |
| }, |
| { |
| "id": "609", |
| "name": "Double-Checked Locking" |
| }, |
| { |
| "id": "611", |
| "name": "Improper Restriction of XML External Entity Reference" |
| }, |
| { |
| "id": "612", |
| "name": "Improper Authorization of Index Containing Sensitive Information" |
| }, |
| { |
| "id": "613", |
| "name": "Insufficient Session Expiration" |
| }, |
| { |
| "id": "617", |
| "name": "Reachable Assertion" |
| }, |
| { |
| "id": "619", |
| "name": "Dangling Database Cursor ('Cursor Injection')" |
| }, |
| { |
| "id": "620", |
| "name": "Unverified Password Change" |
| }, |
| { |
| "id": "624", |
| "name": "Executable Regular Expression Error" |
| }, |
| { |
| "id": "625", |
| "name": "Permissive Regular Expression" |
| }, |
| { |
| "id": "628", |
| "name": "Function Call with Incorrectly Specified Arguments" |
| }, |
| { |
| "id": "639", |
| "name": "Authorization Bypass Through User-Controlled Key" |
| }, |
| { |
| "id": "640", |
| "name": "Weak Password Recovery Mechanism for Forgotten Password" |
| }, |
| { |
| "id": "641", |
| "name": "Improper Restriction of Names for Files and Other Resources" |
| }, |
| { |
| "id": "643", |
| "name": "Improper Neutralization of Data within XPath Expressions ('XPath Injection')" |
| }, |
| { |
| "id": "645", |
| "name": "Overly Restrictive Account Lockout Mechanism" |
| }, |
| { |
| "id": "648", |
| "name": "Incorrect Use of Privileged APIs" |
| }, |
| { |
| "id": "649", |
| "name": "Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking" |
| }, |
| { |
| "id": "652", |
| "name": "Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')" |
| }, |
| { |
| "id": "654", |
| "name": "Reliance on a Single Factor in a Security Decision" |
| }, |
| { |
| "id": "663", |
| "name": "Use of a Non-reentrant Function in a Concurrent Context" |
| }, |
| { |
| "id": "676", |
| "name": "Use of Potentially Dangerous Function" |
| }, |
| { |
| "id": "680", |
| "name": "Integer Overflow to Buffer Overflow" |
| }, |
| { |
| "id": "681", |
| "name": "Incorrect Conversion between Numeric Types" |
| }, |
| { |
| "id": "689", |
| "name": "Permission Race Condition During Resource Copy" |
| }, |
| { |
| "id": "690", |
| "name": "Unchecked Return Value to NULL Pointer Dereference" |
| }, |
| { |
| "id": "692", |
| "name": "Incomplete Denylist to Cross-Site Scripting" |
| }, |
| { |
| "id": "694", |
| "name": "Use of Multiple Resources with Duplicate Identifier" |
| }, |
| { |
| "id": "695", |
| "name": "Use of Low-Level Functionality" |
| }, |
| { |
| "id": "698", |
| "name": "Execution After Redirect (EAR)" |
| }, |
| { |
| "id": "708", |
| "name": "Incorrect Ownership Assignment" |
| }, |
| { |
| "id": "733", |
| "name": "Compiler Optimization Removal or Modification of Security-critical Code" |
| }, |
| { |
| "id": "749", |
| "name": "Exposed Dangerous Method or Function" |
| }, |
| { |
| "id": "756", |
| "name": "Missing Custom Error Page" |
| }, |
| { |
| "id": "757", |
| "name": "Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')" |
| }, |
| { |
| "id": "763", |
| "name": "Release of Invalid Pointer or Reference" |
| }, |
| { |
| "id": "764", |
| "name": "Multiple Locks of a Critical Resource" |
| }, |
| { |
| "id": "765", |
| "name": "Multiple Unlocks of a Critical Resource" |
| }, |
| { |
| "id": "766", |
| "name": "Critical Data Element Declared Public" |
| }, |
| { |
| "id": "767", |
| "name": "Access to Critical Private Variable via Public Method" |
| }, |
| { |
| "id": "770", |
| "name": "Allocation of Resources Without Limits or Throttling" |
| }, |
| { |
| "id": "771", |
| "name": "Missing Reference to Active Allocated Resource" |
| }, |
| { |
| "id": "772", |
| "name": "Missing Release of Resource after Effective Lifetime" |
| }, |
| { |
| "id": "776", |
| "name": "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')" |
| }, |
| { |
| "id": "778", |
| "name": "Insufficient Logging" |
| }, |
| { |
| "id": "779", |
| "name": "Logging of Excessive Data" |
| }, |
| { |
| "id": "783", |
| "name": "Operator Precedence Logic Error" |
| }, |
| { |
| "id": "786", |
| "name": "Access of Memory Location Before Start of Buffer" |
| }, |
| { |
| "id": "787", |
| "name": "Out-of-bounds Write" |
| }, |
| { |
| "id": "788", |
| "name": "Access of Memory Location After End of Buffer" |
| }, |
| { |
| "id": "791", |
| "name": "Incomplete Filtering of Special Elements" |
| }, |
| { |
| "id": "795", |
| "name": "Only Filtering Special Elements at a Specified Location" |
| }, |
| { |
| "id": "798", |
| "name": "Use of Hard-coded Credentials" |
| }, |
| { |
| "id": "804", |
| "name": "Guessable CAPTCHA" |
| }, |
| { |
| "id": "805", |
| "name": "Buffer Access with Incorrect Length Value" |
| }, |
| { |
| "id": "807", |
| "name": "Reliance on Untrusted Inputs in a Security Decision" |
| }, |
| { |
| "id": "820", |
| "name": "Missing Synchronization" |
| }, |
| { |
| "id": "821", |
| "name": "Incorrect Synchronization" |
| }, |
| { |
| "id": "822", |
| "name": "Untrusted Pointer Dereference" |
| }, |
| { |
| "id": "823", |
| "name": "Use of Out-of-range Pointer Offset" |
| }, |
| { |
| "id": "824", |
| "name": "Access of Uninitialized Pointer" |
| }, |
| { |
| "id": "825", |
| "name": "Expired Pointer Dereference" |
| }, |
| { |
| "id": "826", |
| "name": "Premature Release of Resource During Expected Lifetime" |
| }, |
| { |
| "id": "829", |
| "name": "Inclusion of Functionality from Untrusted Control Sphere" |
| }, |
| { |
| "id": "832", |
| "name": "Unlock of a Resource that is not Locked" |
| }, |
| { |
| "id": "833", |
| "name": "Deadlock" |
| }, |
| { |
| "id": "835", |
| "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" |
| }, |
| { |
| "id": "836", |
| "name": "Use of Password Hash Instead of Password for Authentication" |
| }, |
| { |
| "id": "837", |
| "name": "Improper Enforcement of a Single, Unique Action" |
| }, |
| { |
| "id": "838", |
| "name": "Inappropriate Encoding for Output Context" |
| }, |
| { |
| "id": "839", |
| "name": "Numeric Range Comparison Without Minimum Check" |
| }, |
| { |
| "id": "841", |
| "name": "Improper Enforcement of Behavioral Workflow" |
| }, |
| { |
| "id": "842", |
| "name": "Placement of User into Incorrect Group" |
| }, |
| { |
| "id": "843", |
| "name": "Access of Resource Using Incompatible Type ('Type Confusion')" |
| }, |
| { |
| "id": "908", |
| "name": "Use of Uninitialized Resource" |
| }, |
| { |
| "id": "910", |
| "name": "Use of Expired File Descriptor" |
| }, |
| { |
| "id": "911", |
| "name": "Improper Update of Reference Count" |
| }, |
| { |
| "id": "914", |
| "name": "Improper Control of Dynamically-Identified Variables" |
| }, |
| { |
| "id": "915", |
| "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" |
| }, |
| { |
| "id": "916", |
| "name": "Use of Password Hash With Insufficient Computational Effort" |
| }, |
| { |
| "id": "917", |
| "name": "Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')" |
| }, |
| { |
| "id": "918", |
| "name": "Server-Side Request Forgery (SSRF)" |
| }, |
| { |
| "id": "920", |
| "name": "Improper Restriction of Power Consumption" |
| }, |
| { |
| "id": "921", |
| "name": "Storage of Sensitive Data in a Mechanism without Access Control" |
| }, |
| { |
| "id": "924", |
| "name": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" |
| }, |
| { |
| "id": "939", |
| "name": "Improper Authorization in Handler for Custom URL Scheme" |
| }, |
| { |
| "id": "940", |
| "name": "Improper Verification of Source of a Communication Channel" |
| }, |
| { |
| "id": "941", |
| "name": "Incorrectly Specified Destination in a Communication Channel" |
| }, |
| { |
| "id": "1007", |
| "name": "Insufficient Visual Distinction of Homoglyphs Presented to User" |
| }, |
| { |
| "id": "1021", |
| "name": "Improper Restriction of Rendered UI Layers or Frames" |
| }, |
| { |
| "id": "1024", |
| "name": "Comparison of Incompatible Types" |
| }, |
| { |
| "id": "1025", |
| "name": "Comparison Using Wrong Factors" |
| }, |
| { |
| "id": "1037", |
| "name": "Processor Optimization Removal or Modification of Security-critical Code" |
| }, |
| { |
| "id": "1041", |
| "name": "Use of Redundant Code" |
| }, |
| { |
| "id": "1043", |
| "name": "Data Element Aggregating an Excessively Large Number of Non-Primitive Elements" |
| }, |
| { |
| "id": "1044", |
| "name": "Architecture with Number of Horizontal Layers Outside of Expected Range" |
| }, |
| { |
| "id": "1045", |
| "name": "Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor" |
| }, |
| { |
| "id": "1046", |
| "name": "Creation of Immutable Text Using String Concatenation" |
| }, |
| { |
| "id": "1047", |
| "name": "Modules with Circular Dependencies" |
| }, |
| { |
| "id": "1048", |
| "name": "Invokable Control Element with Large Number of Outward Calls" |
| }, |
| { |
| "id": "1049", |
| "name": "Excessive Data Query Operations in a Large Data Table" |
| }, |
| { |
| "id": "1050", |
| "name": "Excessive Platform Resource Consumption within a Loop" |
| }, |
| { |
| "id": "1051", |
| "name": "Initialization with Hard-Coded Network Resource Configuration Data" |
| }, |
| { |
| "id": "1052", |
| "name": "Excessive Use of Hard-Coded Literals in Initialization" |
| }, |
| { |
| "id": "1053", |
| "name": "Missing Documentation for Design" |
| }, |
| { |
| "id": "1054", |
| "name": "Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer" |
| }, |
| { |
| "id": "1055", |
| "name": "Multiple Inheritance from Concrete Classes" |
| }, |
| { |
| "id": "1056", |
| "name": "Invokable Control Element with Variadic Parameters" |
| }, |
| { |
| "id": "1057", |
| "name": "Data Access Operations Outside of Expected Data Manager Component" |
| }, |
| { |
| "id": "1058", |
| "name": "Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element" |
| }, |
| { |
| "id": "1060", |
| "name": "Excessive Number of Inefficient Server-Side Data Accesses" |
| }, |
| { |
| "id": "1062", |
| "name": "Parent Class with References to Child Class" |
| }, |
| { |
| "id": "1063", |
| "name": "Creation of Class Instance within a Static Code Block" |
| }, |
| { |
| "id": "1064", |
| "name": "Invokable Control Element with Signature Containing an Excessive Number of Parameters" |
| }, |
| { |
| "id": "1065", |
| "name": "Runtime Resource Management Control Element in a Component Built to Run on Application Servers" |
| }, |
| { |
| "id": "1066", |
| "name": "Missing Serialization Control Element" |
| }, |
| { |
| "id": "1067", |
| "name": "Excessive Execution of Sequential Searches of Data Resource" |
| }, |
| { |
| "id": "1068", |
| "name": "Inconsistency Between Implementation and Documented Design" |
| }, |
| { |
| "id": "1070", |
| "name": "Serializable Data Element Containing non-Serializable Item Elements" |
| }, |
| { |
| "id": "1071", |
| "name": "Empty Code Block" |
| }, |
| { |
| "id": "1072", |
| "name": "Data Resource Access without Use of Connection Pooling" |
| }, |
| { |
| "id": "1073", |
| "name": "Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses" |
| }, |
| { |
| "id": "1074", |
| "name": "Class with Excessively Deep Inheritance" |
| }, |
| { |
| "id": "1075", |
| "name": "Unconditional Control Flow Transfer outside of Switch Block" |
| }, |
| { |
| "id": "1079", |
| "name": "Parent Class without Virtual Destructor Method" |
| }, |
| { |
| "id": "1080", |
| "name": "Source Code File with Excessive Number of Lines of Code" |
| }, |
| { |
| "id": "1082", |
| "name": "Class Instance Self Destruction Control Element" |
| }, |
| { |
| "id": "1083", |
| "name": "Data Access from Outside Expected Data Manager Component" |
| }, |
| { |
| "id": "1084", |
| "name": "Invokable Control Element with Excessive File or Data Access Operations" |
| }, |
| { |
| "id": "1085", |
| "name": "Invokable Control Element with Excessive Volume of Commented-out Code" |
| }, |
| { |
| "id": "1086", |
| "name": "Class with Excessive Number of Child Classes" |
| }, |
| { |
| "id": "1087", |
| "name": "Class with Virtual Method without a Virtual Destructor" |
| }, |
| { |
| "id": "1088", |
| "name": "Synchronous Access of Remote Resource without Timeout" |
| }, |
| { |
| "id": "1089", |
| "name": "Large Data Table with Excessive Number of Indices" |
| }, |
| { |
| "id": "1090", |
| "name": "Method Containing Access of a Member Element from Another Class" |
| }, |
| { |
| "id": "1091", |
| "name": "Use of Object without Invoking Destructor Method" |
| }, |
| { |
| "id": "1092", |
| "name": "Use of Same Invokable Control Element in Multiple Architectural Layers" |
| }, |
| { |
| "id": "1094", |
| "name": "Excessive Index Range Scan for a Data Resource" |
| }, |
| { |
| "id": "1095", |
| "name": "Loop Condition Value Update within the Loop" |
| }, |
| { |
| "id": "1097", |
| "name": "Persistent Storable Data Element without Associated Comparison Control Element" |
| }, |
| { |
| "id": "1098", |
| "name": "Data Element containing Pointer Item without Proper Copy Control Element" |
| }, |
| { |
| "id": "1099", |
| "name": "Inconsistent Naming Conventions for Identifiers" |
| }, |
| { |
| "id": "1100", |
| "name": "Insufficient Isolation of System-Dependent Functions" |
| }, |
| { |
| "id": "1101", |
| "name": "Reliance on Runtime Component in Generated Code" |
| }, |
| { |
| "id": "1102", |
| "name": "Reliance on Machine-Dependent Data Representation" |
| }, |
| { |
| "id": "1103", |
| "name": "Use of Platform-Dependent Third Party Components" |
| }, |
| { |
| "id": "1104", |
| "name": "Use of Unmaintained Third Party Components" |
| }, |
| { |
| "id": "1105", |
| "name": "Insufficient Encapsulation of Machine-Dependent Functionality" |
| }, |
| { |
| "id": "1106", |
| "name": "Insufficient Use of Symbolic Constants" |
| }, |
| { |
| "id": "1107", |
| "name": "Insufficient Isolation of Symbolic Constant Definitions" |
| }, |
| { |
| "id": "1108", |
| "name": "Excessive Reliance on Global Variables" |
| }, |
| { |
| "id": "1109", |
| "name": "Use of Same Variable for Multiple Purposes" |
| }, |
| { |
| "id": "1110", |
| "name": "Incomplete Design Documentation" |
| }, |
| { |
| "id": "1111", |
| "name": "Incomplete I/O Documentation" |
| }, |
| { |
| "id": "1112", |
| "name": "Incomplete Documentation of Program Execution" |
| }, |
| { |
| "id": "1113", |
| "name": "Inappropriate Comment Style" |
| }, |
| { |
| "id": "1114", |
| "name": "Inappropriate Whitespace Style" |
| }, |
| { |
| "id": "1115", |
| "name": "Source Code Element without Standard Prologue" |
| }, |
| { |
| "id": "1116", |
| "name": "Inaccurate Comments" |
| }, |
| { |
| "id": "1117", |
| "name": "Callable with Insufficient Behavioral Summary" |
| }, |
| { |
| "id": "1118", |
| "name": "Insufficient Documentation of Error Handling Techniques" |
| }, |
| { |
| "id": "1119", |
| "name": "Excessive Use of Unconditional Branching" |
| }, |
| { |
| "id": "1121", |
| "name": "Excessive McCabe Cyclomatic Complexity" |
| }, |
| { |
| "id": "1122", |
| "name": "Excessive Halstead Complexity" |
| }, |
| { |
| "id": "1123", |
| "name": "Excessive Use of Self-Modifying Code" |
| }, |
| { |
| "id": "1124", |
| "name": "Excessively Deep Nesting" |
| }, |
| { |
| "id": "1125", |
| "name": "Excessive Attack Surface" |
| }, |
| { |
| "id": "1126", |
| "name": "Declaration of Variable with Unnecessarily Wide Scope" |
| }, |
| { |
| "id": "1127", |
| "name": "Compilation with Insufficient Warnings or Errors" |
| }, |
| { |
| "id": "1173", |
| "name": "Improper Use of Validation Framework" |
| }, |
| { |
| "id": "1188", |
| "name": "Initialization of a Resource with an Insecure Default" |
| }, |
| { |
| "id": "1189", |
| "name": "Improper Isolation of Shared Resources on System-on-a-Chip (SoC)" |
| }, |
| { |
| "id": "1190", |
| "name": "DMA Device Enabled Too Early in Boot Phase" |
| }, |
| { |
| "id": "1191", |
| "name": "On-Chip Debug and Test Interface With Improper Access Control" |
| }, |
| { |
| "id": "1192", |
| "name": "Improper Identifier for IP Block used in System-On-Chip (SOC)" |
| }, |
| { |
| "id": "1193", |
| "name": "Power-On of Untrusted Execution Core Before Enabling Fabric Access Control" |
| }, |
| { |
| "id": "1204", |
| "name": "Generation of Weak Initialization Vector (IV)" |
| }, |
| { |
| "id": "1209", |
| "name": "Failure to Disable Reserved Bits" |
| }, |
| { |
| "id": "1220", |
| "name": "Insufficient Granularity of Access Control" |
| }, |
| { |
| "id": "1221", |
| "name": "Incorrect Register Defaults or Module Parameters" |
| }, |
| { |
| "id": "1223", |
| "name": "Race Condition for Write-Once Attributes" |
| }, |
| { |
| "id": "1224", |
| "name": "Improper Restriction of Write-Once Bit Fields" |
| }, |
| { |
| "id": "1230", |
| "name": "Exposure of Sensitive Information Through Metadata" |
| }, |
| { |
| "id": "1231", |
| "name": "Improper Prevention of Lock Bit Modification" |
| }, |
| { |
| "id": "1232", |
| "name": "Improper Lock Behavior After Power State Transition" |
| }, |
| { |
| "id": "1233", |
| "name": "Security-Sensitive Hardware Controls with Missing Lock Bit Protection" |
| }, |
| { |
| "id": "1234", |
| "name": "Hardware Internal or Debug Modes Allow Override of Locks" |
| }, |
| { |
| "id": "1235", |
| "name": "Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations" |
| }, |
| { |
| "id": "1236", |
| "name": "Improper Neutralization of Formula Elements in a CSV File" |
| }, |
| { |
| "id": "1240", |
| "name": "Use of a Cryptographic Primitive with a Risky Implementation" |
| }, |
| { |
| "id": "1241", |
| "name": "Use of Predictable Algorithm in Random Number Generator" |
| }, |
| { |
| "id": "1242", |
| "name": "Inclusion of Undocumented Features or Chicken Bits" |
| }, |
| { |
| "id": "1243", |
| "name": "Sensitive Non-Volatile Information Not Protected During Debug" |
| }, |
| { |
| "id": "1244", |
| "name": "Internal Asset Exposed to Unsafe Debug Access Level or State" |
| }, |
| { |
| "id": "1245", |
| "name": "Improper Finite State Machines (FSMs) in Hardware Logic" |
| }, |
| { |
| "id": "1246", |
| "name": "Improper Write Handling in Limited-write Non-Volatile Memories" |
| }, |
| { |
| "id": "1247", |
| "name": "Improper Protection Against Voltage and Clock Glitches" |
| }, |
| { |
| "id": "1248", |
| "name": "Semiconductor Defects in Hardware Logic with Security-Sensitive Implications" |
| }, |
| { |
| "id": "1249", |
| "name": "Application-Level Admin Tool with Inconsistent View of Underlying Operating System" |
| }, |
| { |
| "id": "1250", |
| "name": "Improper Preservation of Consistency Between Independent Representations of Shared State" |
| }, |
| { |
| "id": "1251", |
| "name": "Mirrored Regions with Different Values" |
| }, |
| { |
| "id": "1252", |
| "name": "CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations" |
| }, |
| { |
| "id": "1253", |
| "name": "Incorrect Selection of Fuse Values" |
| }, |
| { |
| "id": "1254", |
| "name": "Incorrect Comparison Logic Granularity" |
| }, |
| { |
| "id": "1256", |
| "name": "Improper Restriction of Software Interfaces to Hardware Features" |
| }, |
| { |
| "id": "1257", |
| "name": "Improper Access Control Applied to Mirrored or Aliased Memory Regions" |
| }, |
| { |
| "id": "1258", |
| "name": "Exposure of Sensitive System Information Due to Uncleared Debug Information" |
| }, |
| { |
| "id": "1259", |
| "name": "Improper Restriction of Security Token Assignment" |
| }, |
| { |
| "id": "1260", |
| "name": "Improper Handling of Overlap Between Protected Memory Ranges" |
| }, |
| { |
| "id": "1261", |
| "name": "Improper Handling of Single Event Upsets" |
| }, |
| { |
| "id": "1262", |
| "name": "Improper Access Control for Register Interface" |
| }, |
| { |
| "id": "1264", |
| "name": "Hardware Logic with Insecure De-Synchronization between Control and Data Channels" |
| }, |
| { |
| "id": "1265", |
| "name": "Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls" |
| }, |
| { |
| "id": "1266", |
| "name": "Improper Scrubbing of Sensitive Data from Decommissioned Device" |
| }, |
| { |
| "id": "1267", |
| "name": "Policy Uses Obsolete Encoding" |
| }, |
| { |
| "id": "1268", |
| "name": "Policy Privileges are not Assigned Consistently Between Control and Data Agents" |
| }, |
| { |
| "id": "1269", |
| "name": "Product Released in Non-Release Configuration" |
| }, |
| { |
| "id": "1270", |
| "name": "Generation of Incorrect Security Tokens" |
| }, |
| { |
| "id": "1271", |
| "name": "Uninitialized Value on Reset for Registers Holding Security Settings" |
| }, |
| { |
| "id": "1272", |
| "name": "Sensitive Information Uncleared Before Debug/Power State Transition" |
| }, |
| { |
| "id": "1273", |
| "name": "Device Unlock Credential Sharing" |
| }, |
| { |
| "id": "1274", |
| "name": "Improper Access Control for Volatile Memory Containing Boot Code" |
| }, |
| { |
| "id": "1276", |
| "name": "Hardware Child Block Incorrectly Connected to Parent System" |
| }, |
| { |
| "id": "1277", |
| "name": "Firmware Not Updateable" |
| }, |
| { |
| "id": "1278", |
| "name": "Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques" |
| }, |
| { |
| "id": "1279", |
| "name": "Cryptographic Operations are run Before Supporting Units are Ready" |
| }, |
| { |
| "id": "1280", |
| "name": "Access Control Check Implemented After Asset is Accessed" |
| }, |
| { |
| "id": "1281", |
| "name": "Sequence of Processor Instructions Leads to Unexpected Behavior" |
| }, |
| { |
| "id": "1282", |
| "name": "Assumed-Immutable Data is Stored in Writable Memory" |
| }, |
| { |
| "id": "1283", |
| "name": "Mutable Attestation or Measurement Reporting Data" |
| }, |
| { |
| "id": "1284", |
| "name": "Improper Validation of Specified Quantity in Input" |
| }, |
| { |
| "id": "1285", |
| "name": "Improper Validation of Specified Index, Position, or Offset in Input" |
| }, |
| { |
| "id": "1286", |
| "name": "Improper Validation of Syntactic Correctness of Input" |
| }, |
| { |
| "id": "1287", |
| "name": "Improper Validation of Specified Type of Input" |
| }, |
| { |
| "id": "1288", |
| "name": "Improper Validation of Consistency within Input" |
| }, |
| { |
| "id": "1289", |
| "name": "Improper Validation of Unsafe Equivalence in Input" |
| }, |
| { |
| "id": "1290", |
| "name": "Incorrect Decoding of Security Identifiers " |
| }, |
| { |
| "id": "1291", |
| "name": "Public Key Re-Use for Signing both Debug and Production Code" |
| }, |
| { |
| "id": "1292", |
| "name": "Incorrect Conversion of Security Identifiers" |
| }, |
| { |
| "id": "1293", |
| "name": "Missing Source Correlation of Multiple Independent Data" |
| }, |
| { |
| "id": "1295", |
| "name": "Debug Messages Revealing Unnecessary Information" |
| }, |
| { |
| "id": "1296", |
| "name": "Incorrect Chaining or Granularity of Debug Components" |
| }, |
| { |
| "id": "1297", |
| "name": "Unprotected Confidential Information on Device is Accessible by OSAT Vendors" |
| }, |
| { |
| "id": "1298", |
| "name": "Hardware Logic Contains Race Conditions" |
| }, |
| { |
| "id": "1299", |
| "name": "Missing Protection Mechanism for Alternate Hardware Interface" |
| }, |
| { |
| "id": "1300", |
| "name": "Improper Protection of Physical Side Channels" |
| }, |
| { |
| "id": "1301", |
| "name": "Insufficient or Incomplete Data Removal within Hardware Component" |
| }, |
| { |
| "id": "1302", |
| "name": "Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)" |
| }, |
| { |
| "id": "1303", |
| "name": "Non-Transparent Sharing of Microarchitectural Resources" |
| }, |
| { |
| "id": "1304", |
| "name": "Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation" |
| }, |
| { |
| "id": "1310", |
| "name": "Missing Ability to Patch ROM Code" |
| }, |
| { |
| "id": "1311", |
| "name": "Improper Translation of Security Attributes by Fabric Bridge" |
| }, |
| { |
| "id": "1312", |
| "name": "Missing Protection for Mirrored Regions in On-Chip Fabric Firewall" |
| }, |
| { |
| "id": "1313", |
| "name": "Hardware Allows Activation of Test or Debug Logic at Runtime" |
| }, |
| { |
| "id": "1314", |
| "name": "Missing Write Protection for Parametric Data Values" |
| }, |
| { |
| "id": "1315", |
| "name": "Improper Setting of Bus Controlling Capability in Fabric End-point" |
| }, |
| { |
| "id": "1316", |
| "name": "Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges" |
| }, |
| { |
| "id": "1317", |
| "name": "Improper Access Control in Fabric Bridge" |
| }, |
| { |
| "id": "1318", |
| "name": "Missing Support for Security Features in On-chip Fabrics or Buses" |
| }, |
| { |
| "id": "1319", |
| "name": "Improper Protection against Electromagnetic Fault Injection (EM-FI)" |
| }, |
| { |
| "id": "1320", |
| "name": "Improper Protection for Outbound Error Messages and Alert Signals" |
| }, |
| { |
| "id": "1322", |
| "name": "Use of Blocking Code in Single-threaded, Non-blocking Context" |
| }, |
| { |
| "id": "1323", |
| "name": "Improper Management of Sensitive Trace Data" |
| }, |
| { |
| "id": "1325", |
| "name": "Improperly Controlled Sequential Memory Allocation" |
| }, |
| { |
| "id": "1326", |
| "name": "Missing Immutable Root of Trust in Hardware" |
| }, |
| { |
| "id": "1327", |
| "name": "Binding to an Unrestricted IP Address" |
| }, |
| { |
| "id": "1328", |
| "name": "Security Version Number Mutable to Older Versions" |
| }, |
| { |
| "id": "1329", |
| "name": "Reliance on Component That is Not Updateable" |
| }, |
| { |
| "id": "1331", |
| "name": "Improper Isolation of Shared Resources in Network On Chip (NoC)" |
| }, |
| { |
| "id": "1332", |
| "name": "Improper Handling of Faults that Lead to Instruction Skips" |
| }, |
| { |
| "id": "1333", |
| "name": "Inefficient Regular Expression Complexity" |
| }, |
| { |
| "id": "1334", |
| "name": "Unauthorized Error Injection Can Degrade Hardware Redundancy" |
| }, |
| { |
| "id": "1335", |
| "name": "Incorrect Bitwise Shift of Integer" |
| }, |
| { |
| "id": "1336", |
| "name": "Improper Neutralization of Special Elements Used in a Template Engine" |
| }, |
| { |
| "id": "1338", |
| "name": "Improper Protections Against Hardware Overheating" |
| }, |
| { |
| "id": "1339", |
| "name": "Insufficient Precision or Accuracy of a Real Number" |
| }, |
| { |
| "id": "1341", |
| "name": "Multiple Releases of Same Resource or Handle" |
| }, |
| { |
| "id": "1342", |
| "name": "Information Exposure through Microarchitectural State after Transient Execution" |
| }, |
| { |
| "id": "1351", |
| "name": "Improper Handling of Hardware Behavior in Exceptionally Cold Environments" |
| }, |
| { |
| "id": "1386", |
| "name": "Insecure Operation on Windows Junction / Mount Point" |
| }, |
| { |
| "id": "1389", |
| "name": "Incorrect Parsing of Numbers with Different Radices" |
| }, |
| { |
| "id": "1392", |
| "name": "Use of Default Credentials" |
| }, |
| { |
| "id": "1393", |
| "name": "Use of Default Password" |
| }, |
| { |
| "id": "1394", |
| "name": "Use of Default Cryptographic Key" |
| }, |
| { |
| "id": "1420", |
| "name": "Exposure of Sensitive Information during Transient Execution" |
| }, |
| { |
| "id": "1421", |
| "name": "Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution" |
| }, |
| { |
| "id": "1422", |
| "name": "Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution" |
| }, |
| { |
| "id": "1423", |
| "name": "Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution" |
| }, |
| { |
| "id": "1426", |
| "name": "Improper Validation of Generative AI Output" |
| }, |
| { |
| "id": "1427", |
| "name": "Improper Neutralization of Input Used for LLM Prompting" |
| }, |
| { |
| "id": "1428", |
| "name": "Reliance on HTTP instead of HTTPS" |
| }, |
| { |
| "id": "1429", |
| "name": "Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface" |
| }, |
| { |
| "id": "1431", |
| "name": "Driving Intermediate Cryptographic State/Results to Hardware Module Outputs" |
| }, |
| { |
| "id": "1434", |
| "name": "Insecure Setting of Generative AI/ML Model Inference Parameters" |
| } |
| ], |
| "class": [ |
| { |
| "id": "20", |
| "name": "Improper Input Validation" |
| }, |
| { |
| "id": "74", |
| "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" |
| }, |
| { |
| "id": "75", |
| "name": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)" |
| }, |
| { |
| "id": "77", |
| "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')" |
| }, |
| { |
| "id": "99", |
| "name": "Improper Control of Resource Identifiers ('Resource Injection')" |
| }, |
| { |
| "id": "114", |
| "name": "Process Control" |
| }, |
| { |
| "id": "116", |
| "name": "Improper Encoding or Escaping of Output" |
| }, |
| { |
| "id": "118", |
| "name": "Incorrect Access of Indexable Resource ('Range Error')" |
| }, |
| { |
| "id": "119", |
| "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" |
| }, |
| { |
| "id": "138", |
| "name": "Improper Neutralization of Special Elements" |
| }, |
| { |
| "id": "159", |
| "name": "Improper Handling of Invalid Use of Special Elements" |
| }, |
| { |
| "id": "172", |
| "name": "Encoding Error" |
| }, |
| { |
| "id": "185", |
| "name": "Incorrect Regular Expression" |
| }, |
| { |
| "id": "200", |
| "name": "Exposure of Sensitive Information to an Unauthorized Actor" |
| }, |
| { |
| "id": "221", |
| "name": "Information Loss or Omission" |
| }, |
| { |
| "id": "228", |
| "name": "Improper Handling of Syntactically Invalid Structure" |
| }, |
| { |
| "id": "269", |
| "name": "Improper Privilege Management" |
| }, |
| { |
| "id": "271", |
| "name": "Privilege Dropping / Lowering Errors" |
| }, |
| { |
| "id": "282", |
| "name": "Improper Ownership Management" |
| }, |
| { |
| "id": "285", |
| "name": "Improper Authorization" |
| }, |
| { |
| "id": "286", |
| "name": "Incorrect User Management" |
| }, |
| { |
| "id": "287", |
| "name": "Improper Authentication" |
| }, |
| { |
| "id": "300", |
| "name": "Channel Accessible by Non-Endpoint" |
| }, |
| { |
| "id": "311", |
| "name": "Missing Encryption of Sensitive Data" |
| }, |
| { |
| "id": "326", |
| "name": "Inadequate Encryption Strength" |
| }, |
| { |
| "id": "327", |
| "name": "Use of a Broken or Risky Cryptographic Algorithm" |
| }, |
| { |
| "id": "330", |
| "name": "Use of Insufficiently Random Values" |
| }, |
| { |
| "id": "340", |
| "name": "Generation of Predictable Numbers or Identifiers" |
| }, |
| { |
| "id": "345", |
| "name": "Insufficient Verification of Data Authenticity" |
| }, |
| { |
| "id": "346", |
| "name": "Origin Validation Error" |
| }, |
| { |
| "id": "362", |
| "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" |
| }, |
| { |
| "id": "377", |
| "name": "Insecure Temporary File" |
| }, |
| { |
| "id": "400", |
| "name": "Uncontrolled Resource Consumption" |
| }, |
| { |
| "id": "402", |
| "name": "Transmission of Private Resources into a New Sphere ('Resource Leak')" |
| }, |
| { |
| "id": "404", |
| "name": "Improper Resource Shutdown or Release" |
| }, |
| { |
| "id": "405", |
| "name": "Asymmetric Resource Consumption (Amplification)" |
| }, |
| { |
| "id": "406", |
| "name": "Insufficient Control of Network Message Volume (Network Amplification)" |
| }, |
| { |
| "id": "407", |
| "name": "Inefficient Algorithmic Complexity" |
| }, |
| { |
| "id": "410", |
| "name": "Insufficient Resource Pool" |
| }, |
| { |
| "id": "424", |
| "name": "Improper Protection of Alternate Path" |
| }, |
| { |
| "id": "436", |
| "name": "Interpretation Conflict" |
| }, |
| { |
| "id": "441", |
| "name": "Unintended Proxy or Intermediary ('Confused Deputy')" |
| }, |
| { |
| "id": "446", |
| "name": "UI Discrepancy for Security Feature" |
| }, |
| { |
| "id": "451", |
| "name": "User Interface (UI) Misrepresentation of Critical Information" |
| }, |
| { |
| "id": "506", |
| "name": "Embedded Malicious Code" |
| }, |
| { |
| "id": "514", |
| "name": "Covert Channel" |
| }, |
| { |
| "id": "522", |
| "name": "Insufficiently Protected Credentials" |
| }, |
| { |
| "id": "573", |
| "name": "Improper Following of Specification by Caller" |
| }, |
| { |
| "id": "602", |
| "name": "Client-Side Enforcement of Server-Side Security" |
| }, |
| { |
| "id": "610", |
| "name": "Externally Controlled Reference to a Resource in Another Sphere" |
| }, |
| { |
| "id": "636", |
| "name": "Not Failing Securely ('Failing Open')" |
| }, |
| { |
| "id": "637", |
| "name": "Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')" |
| }, |
| { |
| "id": "638", |
| "name": "Not Using Complete Mediation" |
| }, |
| { |
| "id": "642", |
| "name": "External Control of Critical State Data" |
| }, |
| { |
| "id": "653", |
| "name": "Improper Isolation or Compartmentalization" |
| }, |
| { |
| "id": "655", |
| "name": "Insufficient Psychological Acceptability" |
| }, |
| { |
| "id": "656", |
| "name": "Reliance on Security Through Obscurity" |
| }, |
| { |
| "id": "657", |
| "name": "Violation of Secure Design Principles" |
| }, |
| { |
| "id": "662", |
| "name": "Improper Synchronization" |
| }, |
| { |
| "id": "665", |
| "name": "Improper Initialization" |
| }, |
| { |
| "id": "666", |
| "name": "Operation on Resource in Wrong Phase of Lifetime" |
| }, |
| { |
| "id": "667", |
| "name": "Improper Locking" |
| }, |
| { |
| "id": "668", |
| "name": "Exposure of Resource to Wrong Sphere" |
| }, |
| { |
| "id": "669", |
| "name": "Incorrect Resource Transfer Between Spheres" |
| }, |
| { |
| "id": "670", |
| "name": "Always-Incorrect Control Flow Implementation" |
| }, |
| { |
| "id": "671", |
| "name": "Lack of Administrator Control over Security" |
| }, |
| { |
| "id": "672", |
| "name": "Operation on a Resource after Expiration or Release" |
| }, |
| { |
| "id": "673", |
| "name": "External Influence of Sphere Definition" |
| }, |
| { |
| "id": "674", |
| "name": "Uncontrolled Recursion" |
| }, |
| { |
| "id": "675", |
| "name": "Multiple Operations on Resource in Single-Operation Context" |
| }, |
| { |
| "id": "684", |
| "name": "Incorrect Provision of Specified Functionality" |
| }, |
| { |
| "id": "696", |
| "name": "Incorrect Behavior Order" |
| }, |
| { |
| "id": "704", |
| "name": "Incorrect Type Conversion or Cast" |
| }, |
| { |
| "id": "705", |
| "name": "Incorrect Control Flow Scoping" |
| }, |
| { |
| "id": "706", |
| "name": "Use of Incorrectly-Resolved Name or Reference" |
| }, |
| { |
| "id": "732", |
| "name": "Incorrect Permission Assignment for Critical Resource" |
| }, |
| { |
| "id": "754", |
| "name": "Improper Check for Unusual or Exceptional Conditions" |
| }, |
| { |
| "id": "755", |
| "name": "Improper Handling of Exceptional Conditions" |
| }, |
| { |
| "id": "758", |
| "name": "Reliance on Undefined, Unspecified, or Implementation-Defined Behavior" |
| }, |
| { |
| "id": "790", |
| "name": "Improper Filtering of Special Elements" |
| }, |
| { |
| "id": "799", |
| "name": "Improper Control of Interaction Frequency" |
| }, |
| { |
| "id": "834", |
| "name": "Excessive Iteration" |
| }, |
| { |
| "id": "862", |
| "name": "Missing Authorization" |
| }, |
| { |
| "id": "863", |
| "name": "Incorrect Authorization" |
| }, |
| { |
| "id": "909", |
| "name": "Missing Initialization of Resource" |
| }, |
| { |
| "id": "912", |
| "name": "Hidden Functionality" |
| }, |
| { |
| "id": "913", |
| "name": "Improper Control of Dynamically-Managed Code Resources" |
| }, |
| { |
| "id": "922", |
| "name": "Insecure Storage of Sensitive Information" |
| }, |
| { |
| "id": "923", |
| "name": "Improper Restriction of Communication Channel to Intended Endpoints" |
| }, |
| { |
| "id": "943", |
| "name": "Improper Neutralization of Special Elements in Data Query Logic" |
| }, |
| { |
| "id": "1023", |
| "name": "Incomplete Comparison with Missing Factors" |
| }, |
| { |
| "id": "1038", |
| "name": "Insecure Automated Optimizations" |
| }, |
| { |
| "id": "1039", |
| "name": "Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism" |
| }, |
| { |
| "id": "1059", |
| "name": "Insufficient Technical Documentation" |
| }, |
| { |
| "id": "1061", |
| "name": "Insufficient Encapsulation" |
| }, |
| { |
| "id": "1076", |
| "name": "Insufficient Adherence to Expected Conventions" |
| }, |
| { |
| "id": "1078", |
| "name": "Inappropriate Source Code Style or Formatting" |
| }, |
| { |
| "id": "1093", |
| "name": "Excessively Complex Data Representation" |
| }, |
| { |
| "id": "1120", |
| "name": "Excessive Code Complexity" |
| }, |
| { |
| "id": "1164", |
| "name": "Irrelevant Code" |
| }, |
| { |
| "id": "1176", |
| "name": "Inefficient CPU Computation" |
| }, |
| { |
| "id": "1177", |
| "name": "Use of Prohibited Code" |
| }, |
| { |
| "id": "1229", |
| "name": "Creation of Emergent Resource" |
| }, |
| { |
| "id": "1263", |
| "name": "Improper Physical Access Control" |
| }, |
| { |
| "id": "1294", |
| "name": "Insecure Security Identifier Mechanism" |
| }, |
| { |
| "id": "1357", |
| "name": "Reliance on Insufficiently Trustworthy Component" |
| }, |
| { |
| "id": "1384", |
| "name": "Improper Handling of Physical or Environmental Conditions" |
| }, |
| { |
| "id": "1390", |
| "name": "Weak Authentication" |
| }, |
| { |
| "id": "1391", |
| "name": "Use of Weak Credentials" |
| }, |
| { |
| "id": "1395", |
| "name": "Dependency on Vulnerable Third-Party Component" |
| }, |
| { |
| "id": "1419", |
| "name": "Incorrect Initialization of Resource" |
| } |
| ], |
| "pillar": [ |
| { |
| "id": "284", |
| "name": "Improper Access Control" |
| }, |
| { |
| "id": "435", |
| "name": "Improper Interaction Between Multiple Correctly-Behaving Entities" |
| }, |
| { |
| "id": "664", |
| "name": "Improper Control of a Resource Through its Lifetime" |
| }, |
| { |
| "id": "682", |
| "name": "Incorrect Calculation" |
| }, |
| { |
| "id": "691", |
| "name": "Insufficient Control Flow Management" |
| }, |
| { |
| "id": "693", |
| "name": "Protection Mechanism Failure" |
| }, |
| { |
| "id": "697", |
| "name": "Incorrect Comparison" |
| }, |
| { |
| "id": "703", |
| "name": "Improper Check or Handling of Exceptional Conditions" |
| }, |
| { |
| "id": "707", |
| "name": "Improper Neutralization" |
| }, |
| { |
| "id": "710", |
| "name": "Improper Adherence to Coding Standards" |
| } |
| ], |
| "variant": [ |
| { |
| "id": "5", |
| "name": "J2EE Misconfiguration: Data Transmission Without Encryption" |
| }, |
| { |
| "id": "6", |
| "name": "J2EE Misconfiguration: Insufficient Session-ID Length" |
| }, |
| { |
| "id": "7", |
| "name": "J2EE Misconfiguration: Missing Custom Error Page" |
| }, |
| { |
| "id": "8", |
| "name": "J2EE Misconfiguration: Entity Bean Declared Remote" |
| }, |
| { |
| "id": "9", |
| "name": "J2EE Misconfiguration: Weak Access Permissions for EJB Methods" |
| }, |
| { |
| "id": "11", |
| "name": "ASP.NET Misconfiguration: Creating Debug Binary" |
| }, |
| { |
| "id": "12", |
| "name": "ASP.NET Misconfiguration: Missing Custom Error Page" |
| }, |
| { |
| "id": "13", |
| "name": "ASP.NET Misconfiguration: Password in Configuration File" |
| }, |
| { |
| "id": "14", |
| "name": "Compiler Removal of Code to Clear Buffers" |
| }, |
| { |
| "id": "24", |
| "name": "Path Traversal: '../filedir'" |
| }, |
| { |
| "id": "25", |
| "name": "Path Traversal: '/../filedir'" |
| }, |
| { |
| "id": "26", |
| "name": "Path Traversal: '/dir/../filename'" |
| }, |
| { |
| "id": "27", |
| "name": "Path Traversal: 'dir/../../filename'" |
| }, |
| { |
| "id": "28", |
| "name": "Path Traversal: '..filedir'" |
| }, |
| { |
| "id": "29", |
| "name": "Path Traversal: '..filename'" |
| }, |
| { |
| "id": "30", |
| "name": "Path Traversal: 'dir..filename'" |
| }, |
| { |
| "id": "31", |
| "name": "Path Traversal: 'dir....filename'" |
| }, |
| { |
| "id": "32", |
| "name": "Path Traversal: '...' (Triple Dot)" |
| }, |
| { |
| "id": "33", |
| "name": "Path Traversal: '....' (Multiple Dot)" |
| }, |
| { |
| "id": "34", |
| "name": "Path Traversal: '....//'" |
| }, |
| { |
| "id": "35", |
| "name": "Path Traversal: '.../...//'" |
| }, |
| { |
| "id": "37", |
| "name": "Path Traversal: '/absolute/pathname/here'" |
| }, |
| { |
| "id": "38", |
| "name": "Path Traversal: 'absolutepathnamehere'" |
| }, |
| { |
| "id": "39", |
| "name": "Path Traversal: 'C:dirname'" |
| }, |
| { |
| "id": "40", |
| "name": "Path Traversal: 'UNCsharename' (Windows UNC Share)" |
| }, |
| { |
| "id": "42", |
| "name": "Path Equivalence: 'filename.' (Trailing Dot)" |
| }, |
| { |
| "id": "43", |
| "name": "Path Equivalence: 'filename....' (Multiple Trailing Dot)" |
| }, |
| { |
| "id": "44", |
| "name": "Path Equivalence: 'file.name' (Internal Dot)" |
| }, |
| { |
| "id": "45", |
| "name": "Path Equivalence: 'file...name' (Multiple Internal Dot)" |
| }, |
| { |
| "id": "46", |
| "name": "Path Equivalence: 'filename ' (Trailing Space)" |
| }, |
| { |
| "id": "47", |
| "name": "Path Equivalence: ' filename' (Leading Space)" |
| }, |
| { |
| "id": "48", |
| "name": "Path Equivalence: 'file name' (Internal Whitespace)" |
| }, |
| { |
| "id": "49", |
| "name": "Path Equivalence: 'filename/' (Trailing Slash)" |
| }, |
| { |
| "id": "50", |
| "name": "Path Equivalence: '//multiple/leading/slash'" |
| }, |
| { |
| "id": "51", |
| "name": "Path Equivalence: '/multiple//internal/slash'" |
| }, |
| { |
| "id": "52", |
| "name": "Path Equivalence: '/multiple/trailing/slash//'" |
| }, |
| { |
| "id": "53", |
| "name": "Path Equivalence: 'multipleinternalbackslash'" |
| }, |
| { |
| "id": "54", |
| "name": "Path Equivalence: 'filedir' (Trailing Backslash)" |
| }, |
| { |
| "id": "55", |
| "name": "Path Equivalence: '/./' (Single Dot Directory)" |
| }, |
| { |
| "id": "56", |
| "name": "Path Equivalence: 'filedir*' (Wildcard)" |
| }, |
| { |
| "id": "57", |
| "name": "Path Equivalence: 'fakedir/../realdir/filename'" |
| }, |
| { |
| "id": "58", |
| "name": "Path Equivalence: Windows 8.3 Filename" |
| }, |
| { |
| "id": "62", |
| "name": "UNIX Hard Link" |
| }, |
| { |
| "id": "64", |
| "name": "Windows Shortcut Following (.LNK)" |
| }, |
| { |
| "id": "65", |
| "name": "Windows Hard Link" |
| }, |
| { |
| "id": "67", |
| "name": "Improper Handling of Windows Device Names" |
| }, |
| { |
| "id": "69", |
| "name": "Improper Handling of Windows ::DATA Alternate Data Stream" |
| }, |
| { |
| "id": "72", |
| "name": "Improper Handling of Apple HFS+ Alternate Data Stream Path" |
| }, |
| { |
| "id": "80", |
| "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" |
| }, |
| { |
| "id": "81", |
| "name": "Improper Neutralization of Script in an Error Message Web Page" |
| }, |
| { |
| "id": "82", |
| "name": "Improper Neutralization of Script in Attributes of IMG Tags in a Web Page" |
| }, |
| { |
| "id": "83", |
| "name": "Improper Neutralization of Script in Attributes in a Web Page" |
| }, |
| { |
| "id": "84", |
| "name": "Improper Neutralization of Encoded URI Schemes in a Web Page" |
| }, |
| { |
| "id": "85", |
| "name": "Doubled Character XSS Manipulations" |
| }, |
| { |
| "id": "86", |
| "name": "Improper Neutralization of Invalid Characters in Identifiers in Web Pages" |
| }, |
| { |
| "id": "87", |
| "name": "Improper Neutralization of Alternate XSS Syntax" |
| }, |
| { |
| "id": "95", |
| "name": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" |
| }, |
| { |
| "id": "97", |
| "name": "Improper Neutralization of Server-Side Includes (SSI) Within a Web Page" |
| }, |
| { |
| "id": "98", |
| "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')" |
| }, |
| { |
| "id": "102", |
| "name": "Struts: Duplicate Validation Forms" |
| }, |
| { |
| "id": "103", |
| "name": "Struts: Incomplete validate() Method Definition" |
| }, |
| { |
| "id": "104", |
| "name": "Struts: Form Bean Does Not Extend Validation Class" |
| }, |
| { |
| "id": "105", |
| "name": "Struts: Form Field Without Validator" |
| }, |
| { |
| "id": "106", |
| "name": "Struts: Plug-in Framework not in Use" |
| }, |
| { |
| "id": "107", |
| "name": "Struts: Unused Validation Form" |
| }, |
| { |
| "id": "108", |
| "name": "Struts: Unvalidated Action Form" |
| }, |
| { |
| "id": "109", |
| "name": "Struts: Validator Turned Off" |
| }, |
| { |
| "id": "110", |
| "name": "Struts: Validator Without Form Field" |
| }, |
| { |
| "id": "111", |
| "name": "Direct Use of Unsafe JNI" |
| }, |
| { |
| "id": "113", |
| "name": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')" |
| }, |
| { |
| "id": "121", |
| "name": "Stack-based Buffer Overflow" |
| }, |
| { |
| "id": "122", |
| "name": "Heap-based Buffer Overflow" |
| }, |
| { |
| "id": "126", |
| "name": "Buffer Over-read" |
| }, |
| { |
| "id": "127", |
| "name": "Buffer Under-read" |
| }, |
| { |
| "id": "129", |
| "name": "Improper Validation of Array Index" |
| }, |
| { |
| "id": "141", |
| "name": "Improper Neutralization of Parameter/Argument Delimiters" |
| }, |
| { |
| "id": "142", |
| "name": "Improper Neutralization of Value Delimiters" |
| }, |
| { |
| "id": "143", |
| "name": "Improper Neutralization of Record Delimiters" |
| }, |
| { |
| "id": "144", |
| "name": "Improper Neutralization of Line Delimiters" |
| }, |
| { |
| "id": "145", |
| "name": "Improper Neutralization of Section Delimiters" |
| }, |
| { |
| "id": "146", |
| "name": "Improper Neutralization of Expression/Command Delimiters" |
| }, |
| { |
| "id": "147", |
| "name": "Improper Neutralization of Input Terminators" |
| }, |
| { |
| "id": "148", |
| "name": "Improper Neutralization of Input Leaders" |
| }, |
| { |
| "id": "149", |
| "name": "Improper Neutralization of Quoting Syntax" |
| }, |
| { |
| "id": "150", |
| "name": "Improper Neutralization of Escape, Meta, or Control Sequences" |
| }, |
| { |
| "id": "151", |
| "name": "Improper Neutralization of Comment Delimiters" |
| }, |
| { |
| "id": "152", |
| "name": "Improper Neutralization of Macro Symbols" |
| }, |
| { |
| "id": "153", |
| "name": "Improper Neutralization of Substitution Characters" |
| }, |
| { |
| "id": "154", |
| "name": "Improper Neutralization of Variable Name Delimiters" |
| }, |
| { |
| "id": "155", |
| "name": "Improper Neutralization of Wildcards or Matching Symbols" |
| }, |
| { |
| "id": "156", |
| "name": "Improper Neutralization of Whitespace" |
| }, |
| { |
| "id": "157", |
| "name": "Failure to Sanitize Paired Delimiters" |
| }, |
| { |
| "id": "158", |
| "name": "Improper Neutralization of Null Byte or NUL Character" |
| }, |
| { |
| "id": "160", |
| "name": "Improper Neutralization of Leading Special Elements" |
| }, |
| { |
| "id": "161", |
| "name": "Improper Neutralization of Multiple Leading Special Elements" |
| }, |
| { |
| "id": "162", |
| "name": "Improper Neutralization of Trailing Special Elements" |
| }, |
| { |
| "id": "163", |
| "name": "Improper Neutralization of Multiple Trailing Special Elements" |
| }, |
| { |
| "id": "164", |
| "name": "Improper Neutralization of Internal Special Elements" |
| }, |
| { |
| "id": "165", |
| "name": "Improper Neutralization of Multiple Internal Special Elements" |
| }, |
| { |
| "id": "173", |
| "name": "Improper Handling of Alternate Encoding" |
| }, |
| { |
| "id": "174", |
| "name": "Double Decoding of the Same Data" |
| }, |
| { |
| "id": "175", |
| "name": "Improper Handling of Mixed Encoding" |
| }, |
| { |
| "id": "176", |
| "name": "Improper Handling of Unicode Encoding" |
| }, |
| { |
| "id": "177", |
| "name": "Improper Handling of URL Encoding (Hex Encoding)" |
| }, |
| { |
| "id": "180", |
| "name": "Incorrect Behavior Order: Validate Before Canonicalize" |
| }, |
| { |
| "id": "181", |
| "name": "Incorrect Behavior Order: Validate Before Filter" |
| }, |
| { |
| "id": "187", |
| "name": "Partial String Comparison" |
| }, |
| { |
| "id": "192", |
| "name": "Integer Coercion Error" |
| }, |
| { |
| "id": "194", |
| "name": "Unexpected Sign Extension" |
| }, |
| { |
| "id": "195", |
| "name": "Signed to Unsigned Conversion Error" |
| }, |
| { |
| "id": "196", |
| "name": "Unsigned to Signed Conversion Error" |
| }, |
| { |
| "id": "198", |
| "name": "Use of Incorrect Byte Ordering" |
| }, |
| { |
| "id": "206", |
| "name": "Observable Internal Behavioral Discrepancy" |
| }, |
| { |
| "id": "207", |
| "name": "Observable Behavioral Discrepancy With Equivalent Products" |
| }, |
| { |
| "id": "219", |
| "name": "Storage of File with Sensitive Data Under Web Root" |
| }, |
| { |
| "id": "220", |
| "name": "Storage of File With Sensitive Data Under FTP Root" |
| }, |
| { |
| "id": "230", |
| "name": "Improper Handling of Missing Values" |
| }, |
| { |
| "id": "231", |
| "name": "Improper Handling of Extra Values" |
| }, |
| { |
| "id": "232", |
| "name": "Improper Handling of Undefined Values" |
| }, |
| { |
| "id": "234", |
| "name": "Failure to Handle Missing Parameter" |
| }, |
| { |
| "id": "235", |
| "name": "Improper Handling of Extra Parameters" |
| }, |
| { |
| "id": "236", |
| "name": "Improper Handling of Undefined Parameters" |
| }, |
| { |
| "id": "238", |
| "name": "Improper Handling of Incomplete Structural Elements" |
| }, |
| { |
| "id": "239", |
| "name": "Failure to Handle Incomplete Element" |
| }, |
| { |
| "id": "243", |
| "name": "Creation of chroot Jail Without Changing Working Directory" |
| }, |
| { |
| "id": "244", |
| "name": "Improper Clearing of Heap Memory Before Release ('Heap Inspection')" |
| }, |
| { |
| "id": "245", |
| "name": "J2EE Bad Practices: Direct Management of Connections" |
| }, |
| { |
| "id": "246", |
| "name": "J2EE Bad Practices: Direct Use of Sockets" |
| }, |
| { |
| "id": "258", |
| "name": "Empty Password in Configuration File" |
| }, |
| { |
| "id": "259", |
| "name": "Use of Hard-coded Password" |
| }, |
| { |
| "id": "277", |
| "name": "Insecure Inherited Permissions" |
| }, |
| { |
| "id": "278", |
| "name": "Insecure Preserved Inherited Permissions" |
| }, |
| { |
| "id": "279", |
| "name": "Incorrect Execution-Assigned Permissions" |
| }, |
| { |
| "id": "291", |
| "name": "Reliance on IP Address for Authentication" |
| }, |
| { |
| "id": "293", |
| "name": "Using Referer Field for Authentication" |
| }, |
| { |
| "id": "297", |
| "name": "Improper Validation of Certificate with Host Mismatch" |
| }, |
| { |
| "id": "298", |
| "name": "Improper Validation of Certificate Expiration" |
| }, |
| { |
| "id": "313", |
| "name": "Cleartext Storage in a File or on Disk" |
| }, |
| { |
| "id": "314", |
| "name": "Cleartext Storage in the Registry" |
| }, |
| { |
| "id": "315", |
| "name": "Cleartext Storage of Sensitive Information in a Cookie" |
| }, |
| { |
| "id": "316", |
| "name": "Cleartext Storage of Sensitive Information in Memory" |
| }, |
| { |
| "id": "317", |
| "name": "Cleartext Storage of Sensitive Information in GUI" |
| }, |
| { |
| "id": "318", |
| "name": "Cleartext Storage of Sensitive Information in Executable" |
| }, |
| { |
| "id": "321", |
| "name": "Use of Hard-coded Cryptographic Key" |
| }, |
| { |
| "id": "329", |
| "name": "Generation of Predictable IV with CBC Mode" |
| }, |
| { |
| "id": "332", |
| "name": "Insufficient Entropy in PRNG" |
| }, |
| { |
| "id": "333", |
| "name": "Improper Handling of Insufficient Entropy in TRNG" |
| }, |
| { |
| "id": "336", |
| "name": "Same Seed in Pseudo-Random Number Generator (PRNG)" |
| }, |
| { |
| "id": "337", |
| "name": "Predictable Seed in Pseudo-Random Number Generator (PRNG)" |
| }, |
| { |
| "id": "339", |
| "name": "Small Seed Space in PRNG" |
| }, |
| { |
| "id": "350", |
| "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" |
| }, |
| { |
| "id": "370", |
| "name": "Missing Check for Certificate Revocation after Initial Check" |
| }, |
| { |
| "id": "382", |
| "name": "J2EE Bad Practices: Use of System.exit()" |
| }, |
| { |
| "id": "383", |
| "name": "J2EE Bad Practices: Direct Use of Threads" |
| }, |
| { |
| "id": "401", |
| "name": "Missing Release of Memory after Effective Lifetime" |
| }, |
| { |
| "id": "415", |
| "name": "Double Free" |
| }, |
| { |
| "id": "416", |
| "name": "Use After Free" |
| }, |
| { |
| "id": "422", |
| "name": "Unprotected Windows Messaging Channel ('Shatter')" |
| }, |
| { |
| "id": "433", |
| "name": "Unparsed Raw Web Content Delivery" |
| }, |
| { |
| "id": "453", |
| "name": "Insecure Default Variable Initialization" |
| }, |
| { |
| "id": "456", |
| "name": "Missing Initialization of a Variable" |
| }, |
| { |
| "id": "457", |
| "name": "Use of Uninitialized Variable" |
| }, |
| { |
| "id": "462", |
| "name": "Duplicate Key in Associative List (Alist)" |
| }, |
| { |
| "id": "467", |
| "name": "Use of sizeof() on a Pointer Type" |
| }, |
| { |
| "id": "473", |
| "name": "PHP External Variable Modification" |
| }, |
| { |
| "id": "479", |
| "name": "Signal Handler Use of a Non-reentrant Function" |
| }, |
| { |
| "id": "481", |
| "name": "Assigning instead of Comparing" |
| }, |
| { |
| "id": "482", |
| "name": "Comparing instead of Assigning" |
| }, |
| { |
| "id": "486", |
| "name": "Comparison of Classes by Name" |
| }, |
| { |
| "id": "491", |
| "name": "Public cloneable() Method Without Final ('Object Hijack')" |
| }, |
| { |
| "id": "492", |
| "name": "Use of Inner Class Containing Sensitive Data" |
| }, |
| { |
| "id": "493", |
| "name": "Critical Public Variable Without Final Modifier" |
| }, |
| { |
| "id": "495", |
| "name": "Private Data Structure Returned From A Public Method" |
| }, |
| { |
| "id": "496", |
| "name": "Public Data Assigned to Private Array-Typed Field" |
| }, |
| { |
| "id": "498", |
| "name": "Cloneable Class Containing Sensitive Information" |
| }, |
| { |
| "id": "499", |
| "name": "Serializable Class Containing Sensitive Data" |
| }, |
| { |
| "id": "500", |
| "name": "Public Static Field Not Marked Final" |
| }, |
| { |
| "id": "520", |
| "name": ".NET Misconfiguration: Use of Impersonation" |
| }, |
| { |
| "id": "525", |
| "name": "Use of Web Browser Cache Containing Sensitive Information" |
| }, |
| { |
| "id": "526", |
| "name": "Cleartext Storage of Sensitive Information in an Environment Variable" |
| }, |
| { |
| "id": "527", |
| "name": "Exposure of Version-Control Repository to an Unauthorized Control Sphere" |
| }, |
| { |
| "id": "528", |
| "name": "Exposure of Core Dump File to an Unauthorized Control Sphere" |
| }, |
| { |
| "id": "529", |
| "name": "Exposure of Access Control List Files to an Unauthorized Control Sphere" |
| }, |
| { |
| "id": "530", |
| "name": "Exposure of Backup File to an Unauthorized Control Sphere" |
| }, |
| { |
| "id": "531", |
| "name": "Inclusion of Sensitive Information in Test Code" |
| }, |
| { |
| "id": "535", |
| "name": "Exposure of Information Through Shell Error Message" |
| }, |
| { |
| "id": "536", |
| "name": "Servlet Runtime Error Message Containing Sensitive Information" |
| }, |
| { |
| "id": "537", |
| "name": "Java Runtime Error Message Containing Sensitive Information" |
| }, |
| { |
| "id": "539", |
| "name": "Use of Persistent Cookies Containing Sensitive Information" |
| }, |
| { |
| "id": "541", |
| "name": "Inclusion of Sensitive Information in an Include File" |
| }, |
| { |
| "id": "543", |
| "name": "Use of Singleton Pattern Without Synchronization in a Multithreaded Context" |
| }, |
| { |
| "id": "546", |
| "name": "Suspicious Comment" |
| }, |
| { |
| "id": "548", |
| "name": "Exposure of Information Through Directory Listing" |
| }, |
| { |
| "id": "550", |
| "name": "Server-generated Error Message Containing Sensitive Information" |
| }, |
| { |
| "id": "553", |
| "name": "Command Shell in Externally Accessible Directory" |
| }, |
| { |
| "id": "554", |
| "name": "ASP.NET Misconfiguration: Not Using Input Validation Framework" |
| }, |
| { |
| "id": "555", |
| "name": "J2EE Misconfiguration: Plaintext Password in Configuration File" |
| }, |
| { |
| "id": "556", |
| "name": "ASP.NET Misconfiguration: Use of Identity Impersonation" |
| }, |
| { |
| "id": "558", |
| "name": "Use of getlogin() in Multithreaded Application" |
| }, |
| { |
| "id": "560", |
| "name": "Use of umask() with chmod-style Argument" |
| }, |
| { |
| "id": "564", |
| "name": "SQL Injection: Hibernate" |
| }, |
| { |
| "id": "566", |
| "name": "Authorization Bypass Through User-Controlled SQL Primary Key" |
| }, |
| { |
| "id": "568", |
| "name": "finalize() Method Without super.finalize()" |
| }, |
| { |
| "id": "572", |
| "name": "Call to Thread run() instead of start()" |
| }, |
| { |
| "id": "574", |
| "name": "EJB Bad Practices: Use of Synchronization Primitives" |
| }, |
| { |
| "id": "575", |
| "name": "EJB Bad Practices: Use of AWT Swing" |
| }, |
| { |
| "id": "576", |
| "name": "EJB Bad Practices: Use of Java I/O" |
| }, |
| { |
| "id": "577", |
| "name": "EJB Bad Practices: Use of Sockets" |
| }, |
| { |
| "id": "578", |
| "name": "EJB Bad Practices: Use of Class Loader" |
| }, |
| { |
| "id": "579", |
| "name": "J2EE Bad Practices: Non-serializable Object Stored in Session" |
| }, |
| { |
| "id": "580", |
| "name": "clone() Method Without super.clone()" |
| }, |
| { |
| "id": "581", |
| "name": "Object Model Violation: Just One of Equals and Hashcode Defined" |
| }, |
| { |
| "id": "582", |
| "name": "Array Declared Public, Final, and Static" |
| }, |
| { |
| "id": "583", |
| "name": "finalize() Method Declared Public" |
| }, |
| { |
| "id": "585", |
| "name": "Empty Synchronized Block" |
| }, |
| { |
| "id": "587", |
| "name": "Assignment of a Fixed Address to a Pointer" |
| }, |
| { |
| "id": "588", |
| "name": "Attempt to Access Child of a Non-structure Pointer" |
| }, |
| { |
| "id": "589", |
| "name": "Call to Non-ubiquitous API" |
| }, |
| { |
| "id": "590", |
| "name": "Free of Memory not on the Heap" |
| }, |
| { |
| "id": "591", |
| "name": "Sensitive Data Storage in Improperly Locked Memory" |
| }, |
| { |
| "id": "593", |
| "name": "Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created" |
| }, |
| { |
| "id": "594", |
| "name": "J2EE Framework: Saving Unserializable Objects to Disk" |
| }, |
| { |
| "id": "595", |
| "name": "Comparison of Object References Instead of Object Contents" |
| }, |
| { |
| "id": "597", |
| "name": "Use of Wrong Operator in String Comparison" |
| }, |
| { |
| "id": "598", |
| "name": "Use of GET Request Method With Sensitive Query Strings" |
| }, |
| { |
| "id": "599", |
| "name": "Missing Validation of OpenSSL Certificate" |
| }, |
| { |
| "id": "600", |
| "name": "Uncaught Exception in Servlet " |
| }, |
| { |
| "id": "605", |
| "name": "Multiple Binds to the Same Port" |
| }, |
| { |
| "id": "607", |
| "name": "Public Static Final Field References Mutable Object" |
| }, |
| { |
| "id": "608", |
| "name": "Struts: Non-private Field in ActionForm Class" |
| }, |
| { |
| "id": "614", |
| "name": "Sensitive Cookie in HTTPS Session Without 'Secure' Attribute" |
| }, |
| { |
| "id": "615", |
| "name": "Inclusion of Sensitive Information in Source Code Comments" |
| }, |
| { |
| "id": "616", |
| "name": "Incomplete Identification of Uploaded File Variables (PHP)" |
| }, |
| { |
| "id": "618", |
| "name": "Exposed Unsafe ActiveX Method" |
| }, |
| { |
| "id": "621", |
| "name": "Variable Extraction Error" |
| }, |
| { |
| "id": "622", |
| "name": "Improper Validation of Function Hook Arguments" |
| }, |
| { |
| "id": "623", |
| "name": "Unsafe ActiveX Control Marked Safe For Scripting" |
| }, |
| { |
| "id": "626", |
| "name": "Null Byte Interaction Error (Poison Null Byte)" |
| }, |
| { |
| "id": "627", |
| "name": "Dynamic Variable Evaluation" |
| }, |
| { |
| "id": "644", |
| "name": "Improper Neutralization of HTTP Headers for Scripting Syntax" |
| }, |
| { |
| "id": "646", |
| "name": "Reliance on File Name or Extension of Externally-Supplied File" |
| }, |
| { |
| "id": "647", |
| "name": "Use of Non-Canonical URL Paths for Authorization Decisions" |
| }, |
| { |
| "id": "650", |
| "name": "Trusting HTTP Permission Methods on the Server Side" |
| }, |
| { |
| "id": "651", |
| "name": "Exposure of WSDL File Containing Sensitive Information" |
| }, |
| { |
| "id": "683", |
| "name": "Function Call With Incorrect Order of Arguments" |
| }, |
| { |
| "id": "685", |
| "name": "Function Call With Incorrect Number of Arguments" |
| }, |
| { |
| "id": "686", |
| "name": "Function Call With Incorrect Argument Type" |
| }, |
| { |
| "id": "687", |
| "name": "Function Call With Incorrectly Specified Argument Value" |
| }, |
| { |
| "id": "688", |
| "name": "Function Call With Incorrect Variable or Reference as Argument" |
| }, |
| { |
| "id": "759", |
| "name": "Use of a One-Way Hash without a Salt" |
| }, |
| { |
| "id": "760", |
| "name": "Use of a One-Way Hash with a Predictable Salt" |
| }, |
| { |
| "id": "761", |
| "name": "Free of Pointer not at Start of Buffer" |
| }, |
| { |
| "id": "762", |
| "name": "Mismatched Memory Management Routines" |
| }, |
| { |
| "id": "768", |
| "name": "Incorrect Short Circuit Evaluation" |
| }, |
| { |
| "id": "773", |
| "name": "Missing Reference to Active File Descriptor or Handle" |
| }, |
| { |
| "id": "774", |
| "name": "Allocation of File Descriptors or Handles Without Limits or Throttling" |
| }, |
| { |
| "id": "775", |
| "name": "Missing Release of File Descriptor or Handle after Effective Lifetime" |
| }, |
| { |
| "id": "777", |
| "name": "Regular Expression without Anchors" |
| }, |
| { |
| "id": "780", |
| "name": "Use of RSA Algorithm without OAEP" |
| }, |
| { |
| "id": "781", |
| "name": "Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code" |
| }, |
| { |
| "id": "782", |
| "name": "Exposed IOCTL with Insufficient Access Control" |
| }, |
| { |
| "id": "784", |
| "name": "Reliance on Cookies without Validation and Integrity Checking in a Security Decision" |
| }, |
| { |
| "id": "785", |
| "name": "Use of Path Manipulation Function without Maximum-sized Buffer" |
| }, |
| { |
| "id": "789", |
| "name": "Memory Allocation with Excessive Size Value" |
| }, |
| { |
| "id": "792", |
| "name": "Incomplete Filtering of One or More Instances of Special Elements" |
| }, |
| { |
| "id": "793", |
| "name": "Only Filtering One Instance of a Special Element" |
| }, |
| { |
| "id": "794", |
| "name": "Incomplete Filtering of Multiple Instances of Special Elements" |
| }, |
| { |
| "id": "796", |
| "name": "Only Filtering Special Elements Relative to a Marker" |
| }, |
| { |
| "id": "797", |
| "name": "Only Filtering Special Elements at an Absolute Position" |
| }, |
| { |
| "id": "806", |
| "name": "Buffer Access Using Size of Source Buffer" |
| }, |
| { |
| "id": "827", |
| "name": "Improper Control of Document Type Definition" |
| }, |
| { |
| "id": "828", |
| "name": "Signal Handler with Functionality that is not Asynchronous-Safe" |
| }, |
| { |
| "id": "830", |
| "name": "Inclusion of Web Functionality from an Untrusted Source" |
| }, |
| { |
| "id": "831", |
| "name": "Signal Handler Function Associated with Multiple Signals" |
| }, |
| { |
| "id": "925", |
| "name": "Improper Verification of Intent by Broadcast Receiver" |
| }, |
| { |
| "id": "926", |
| "name": "Improper Export of Android Application Components" |
| }, |
| { |
| "id": "927", |
| "name": "Use of Implicit Intent for Sensitive Communication" |
| }, |
| { |
| "id": "942", |
| "name": "Permissive Cross-domain Security Policy with Untrusted Domains" |
| }, |
| { |
| "id": "1004", |
| "name": "Sensitive Cookie Without 'HttpOnly' Flag" |
| }, |
| { |
| "id": "1022", |
| "name": "Use of Web Link to Untrusted Target with window.opener Access" |
| }, |
| { |
| "id": "1042", |
| "name": "Static Member Data Element outside of a Singleton Class Element" |
| }, |
| { |
| "id": "1069", |
| "name": "Empty Exception Block" |
| }, |
| { |
| "id": "1077", |
| "name": "Floating Point Comparison with Incorrect Operator" |
| }, |
| { |
| "id": "1096", |
| "name": "Singleton Class Instance Creation without Proper Locking or Synchronization" |
| }, |
| { |
| "id": "1174", |
| "name": "ASP.NET Misconfiguration: Improper Model Validation" |
| }, |
| { |
| "id": "1222", |
| "name": "Insufficient Granularity of Address Regions Protected by Register Locks" |
| }, |
| { |
| "id": "1239", |
| "name": "Improper Zeroization of Hardware Register" |
| }, |
| { |
| "id": "1255", |
| "name": "Comparison Logic is Vulnerable to Power Side-Channel Attacks" |
| }, |
| { |
| "id": "1275", |
| "name": "Sensitive Cookie with Improper SameSite Attribute" |
| }, |
| { |
| "id": "1321", |
| "name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')" |
| }, |
| { |
| "id": "1330", |
| "name": "Remanent Data Readable after Memory Erase" |
| }, |
| { |
| "id": "1385", |
| "name": "Missing Origin Validation in WebSockets" |
| } |
| ] |
| }, |
| "decoder_bias": true, |
| "deterministic_flash_attn": false, |
| "dtype": "float32", |
| "embedding_dropout": 0.0, |
| "eos_token_id": 50282, |
| "global_attn_every_n_layers": 3, |
| "gradient_checkpointing": false, |
| "hidden_activation": "gelu", |
| "hidden_size": 768, |
| "id2label": { |
| "0": "LABEL_0" |
| }, |
| "initializer_cutoff_factor": 2.0, |
| "initializer_range": 0.02, |
| "intermediate_size": 1152, |
| "label2id": { |
| "LABEL_0": 0 |
| }, |
| "layer_norm_eps": 1e-05, |
| "layer_types": [ |
| "full_attention", |
| "sliding_attention", |
| "sliding_attention", |
| "full_attention", |
| "sliding_attention", |
| "sliding_attention", |
| "full_attention", |
| "sliding_attention", |
| "sliding_attention", |
| "full_attention", |
| "sliding_attention", |
| "sliding_attention", |
| "full_attention", |
| "sliding_attention", |
| "sliding_attention", |
| "full_attention", |
| "sliding_attention", |
| "sliding_attention", |
| "full_attention", |
| "sliding_attention", |
| "sliding_attention", |
| "full_attention" |
| ], |
| "local_attention": 128, |
| "max_position_embeddings": 8192, |
| "mlp_bias": false, |
| "mlp_dropout": 0.0, |
| "model_type": "modernbert", |
| "norm_bias": false, |
| "norm_eps": 1e-05, |
| "num_attention_heads": 12, |
| "num_hidden_layers": 22, |
| "pad_token_id": 50283, |
| "position_embedding_type": "absolute", |
| "repad_logits_with_grad": false, |
| "rope_parameters": { |
| "full_attention": { |
| "rope_theta": 160000.0, |
| "rope_type": "default" |
| }, |
| "sliding_attention": { |
| "rope_theta": 10000.0, |
| "rope_type": "default" |
| } |
| }, |
| "sentence_transformers": { |
| "activation_fn": "torch.nn.modules.activation.Sigmoid", |
| "version": "5.0.0" |
| }, |
| "sep_token_id": 50282, |
| "sparse_pred_ignore_index": -100, |
| "sparse_prediction": false, |
| "tie_word_embeddings": true, |
| "transformers_version": "5.0.0", |
| "vocab_size": 50368 |
| } |
|
|