/* Licensed under GPL-3.0 */
package CWE_Reader;

import java.util.HashMap;
import java.util.Map;

/**
 * CWEList class.
 *
 * @author CryptoguardTeam Created on 2018-12-05.
 * @version 03.07.01
 * @since 01.00.07
 *     <p>The Lazy CWE Loader that retrieves CWES for Java
 */
public class CWEList {

  //region Attributes
  private final Double cweVersion = 3.1;
  private Map<Integer, CWE> cweList;
  //endregion

  /** The empty constructor for this class */
  public CWEList() {}

  //region Getters

  /**
   * The "Lazy Loading" Getter for cweList
   *
   * <p>getCweList()
   *
   * @return a {@link java.util.Map} object.
   */
  public Map<Integer, CWE> getCweList() {

    if (this.cweList == null) CWE_Loader();

    return cweList;
  }

  /**
   * The "Lazy Loading" for CWE
   *
   * <p>CWE_Loader()
   */
  private void CWE_Loader() {
    this.cweList = new HashMap<>();

    this.cweList.put(
        256,
        new CWE(
            256,
            "Unprotected Storage of Credentials",
            "Variant,Incomplete",
            "Storing a password in plaintext may result in a system compromise.",
            "Password management issues occur when a password is stored in plaintext in an application's properties or configuration file. Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource.\n::NATURE:ChildOf:CWE ID:522:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:522:VIEW ID:699:ORDINAL:Primary::NATURE:CanAlsoBe:CWE ID:319:VIEW ID:1000::NATURE:CanAlsoBe:CWE ID:319:VIEW ID:699::\n::ORDINALITY:Primary:DESCRIPTION:::\n:::LANGUAGE CLASS:Language-Independent:LANGUAGE PREVALENCE:Undetermined::\n:::PHASE:Architecture and Design:DESCRIPTION::::PHASE:Architecture and Design:DESCRIPTION:::\n::SCOPE:Access Control:TECHNICAL IMPACT:Gain Privileges or Assume Identity::\n::PHASE:Architecture and Design:STRATEGY::EFFECTIVENESS::DESCRIPTION:Avoid storing passwords in easily accessible locations.::PHASE:Architecture and Design:STRATEGY::EFFECTIVENESS::DESCRIPTION:Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.::PHASE::STRATEGY::EFFECTIVENESS:None:DESCRIPTION:A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.::\nTAXONOMY NAME:7 Pernicious Kingdoms:ENTRY NAME:Password Management::::TAXONOMY NAME:Software Fault Patterns:ENTRY ID:SFP23:ENTRY NAME:Exposed Data::"));
    this.cweList.put(
        759,
        new CWE(
            759,
            "Use of a One-Way Hash without a Salt",
            "Base   ",
            "Incomplete",
            "The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input.\nThis makes it easier for attackers to pre-compute the hash value using dictionary attack techniques such as rainbow tables. It should be noted that, despite common perceptions, the use of a good salt with a hash does not sufficiently increase the effort for an attacker who is targeting an individual password, or who has a large amount of computing resources available, such as with cloud-based services or specialized, inexpensive hardware. Offline password cracking can still be effective if the hash function is not expensive to compute; many cryptographic functions are designed to be efficient and can be vulnerable to attacks using massive computing resources, even if the hash is cryptographically strong. The use of a salt only slightly increases the computing requirements for an attacker compared to other strategies such as adaptive hash functions. See CWE-916 for more details.\n::NATURE:ChildOf:CWE ID:916:VIEW ID:699:ORDINAL:Primary::NATURE:ChildOf:CWE ID:916:VIEW ID:1000:ORDINAL:Primary::\n::In cryptography, salt refers to some random addition of data to an input before hashing to make dictionary attacks more difficult.::\n:::PHASE:Implementation:DESCRIPTION:::\n::SCOPE:Access Control:TECHNICAL IMPACT:Bypass Protection Mechanism Gain Privileges or Assume Identity:NOTE:Access Control Bypass Protection Mechanism Gain Privileges or Assume Identity If an attacker can gain access to the hashes, then the lack of a salt makes it easier to conduct brute force attacks using techniques such as rainbow tables.::\n::METHOD:Automated Static Analysis - Binary or Bytecode:EFFECTIVENESS:SOAR Partial:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis::METHOD:Manual Static Analysis - Binary or Bytecode:EFFECTIVENESS:SOAR Partial:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies::METHOD:Manual Static Analysis - Source Code:EFFECTIVENESS:High:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review (not inspections)::METHOD:Automated Static Analysis - Source Code:EFFECTIVENESS:High:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer::METHOD:Automated Static Analysis:EFFECTIVENESS:SOAR Partial:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Configuration Checker::METHOD:Architecture or Design Review:EFFECTIVENESS:High:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)::\n::PHASE:Architecture and Design:STRATEGY::EFFECTIVENESS:High:DESCRIPTION:Use an adaptive hash function that can be configured to change the amount of computational effort needed to compute the hash, such as the number of iterations (stretching) or the amount of memory required. Some hash functions perform salting automatically. These functions can significantly increase the overhead for a brute force attack compared to intentionally-fast functions such as MD5. For example, rainbow table attacks can become infeasible due to the high computing overhead. Finally, since computing power gets faster and cheaper over time, the technique can be reconfigured to increase the workload without forcing an entire replacement of the algorithm in use. Some hash functions that have one or more of these desired properties include bcrypt [REF-291], scrypt [REF-292], and PBKDF2 [REF-293]. While there is active debate about which of these is the most effective, they are all stronger than using salts with hash functions with very little computing overhead. Note that using these functions can have an impact on performance, so they require special consideration to avoid denial-of-service attacks. However, their configurability provides finer control over how much CPU and memory is used, so it could be adjusted to suit the environment's needs.::PHASE:Architecture and Design:STRATEGY::EFFECTIVENESS:Limited:DESCRIPTION:If a technique that requires extra computational effort can not be implemented, then for each password that is processed, generate a new random salt using a strong random number generator with unpredictable seeds. Add the salt to the plaintext password before hashing it. When storing the hash, also store the salt. Do not use the same salt for every password.::PHASE:Implementation Architecture and Design:STRATEGY::EFFECTIVENESS::DESCRIPTION:When using industry-approved techniques, use them correctly. Don't cut corners by skipping resource-intensive steps (CWE-325). These steps are often essential for preventing common attacks.::\n::REFERENCE:CVE-2008-1526:DESCRIPTION:Router does not use a salt with a hash, making it easier to crack passwords.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1526REFERENCE:CVE-2006-1058:DESCRIPTION:Router does not use a salt with a hash, making it easier to crack passwords.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1058\n"));
    this.cweList.put(
        547,
        new CWE(
            547,
            "Use of Hard-coded, Security-relevant Constants",
            "Variant",
            "Draft",
            "The program uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.\nIf the developer does not find all occurrences of the hard-coded constants, an incorrect policy decision may be made if one of the constants is not changed. Making changes to these values will require code changes that may be difficult or impossible once the system is released to the field. In addition, these hard-coded values may become available to attackers if the code is ever disclosed.\n::NATURE:ChildOf:CWE ID:710:VIEW ID:1000:ORDINAL:Primary::\n:::PHASE:Implementation:DESCRIPTION:::\n::SCOPE:Other:TECHNICAL IMPACT:Varies by Context Quality Degradation:NOTE:Other Varies by Context Quality Degradation The existence of hardcoded constants could cause unexpected behavior and the introduction of weaknesses during code maintenance or when making changes to the code if all occurrences are not modified. The use of hardcoded constants is an indication of poor quality.::\n::PHASE:Implementation:STRATEGY::EFFECTIVENESS::DESCRIPTION:Avoid using hard-coded constants. Configuration files offer a more flexible solution.::\nTAXONOMY NAME:CERT C Secure Coding:ENTRY ID:DCL06-C:ENTRY NAME:Use meaningful symbolic constants to represent literal values in program logic::"));
    this.cweList.put(
        349,
        new CWE(
            349,
            "Acceptance of Extraneous Untrusted Data With Trusted Data",
            "Base",
            "Draft",
            "The software, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.\n::NATURE:ChildOf:CWE ID:345:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:345:VIEW ID:699:ORDINAL:Primary::\n:::LANGUAGE CLASS:Language-Independent:LANGUAGE PREVALENCE:Undetermined::\n:::PHASE:Architecture and Design:DESCRIPTION::::PHASE:Implementation:DESCRIPTION:::\n::SCOPE:Access Control:SCOPE:Integrity:TECHNICAL IMPACT:Bypass Protection Mechanism Modify Application Data:NOTE:Access Control Integrity Bypass Protection Mechanism Modify Application Data An attacker could package untrusted data with trusted data to bypass protection mechanisms to gain access to and possibly modify sensitive data.::\n::REFERENCE:CVE-2002-0018:DESCRIPTION:Does not verify that trusted entity is authoritative for all entities in its response.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0018\nTAXONOMY NAME:PLOVER:ENTRY NAME:Untrusted Data Appended with Trusted Data::::TAXONOMY NAME:CERT Java Secure Coding:ENTRY ID:ENV01-J:ENTRY NAME:Place all security-sensitive code in a single JAR and sign and seal it::\n::141::142::75::"));
    this.cweList.put(
        321,
        new CWE(
            321,
            "Use of Hard-coded Cryptographic Key",
            "Base",
            "Draft",
            "The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.\n::NATURE:ChildOf:CWE ID:798:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:798:VIEW ID:699:ORDINAL:Primary::\n:::LANGUAGE CLASS:Language-Independent:LANGUAGE PREVALENCE:Undetermined::\n:::PHASE:Architecture and Design:DESCRIPTION:::\n::SCOPE:Access Control:TECHNICAL IMPACT:Bypass Protection Mechanism Gain Privileges or Assume Identity:NOTE:Access Control Bypass Protection Mechanism Gain Privileges or Assume Identity If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question.::\n::PHASE:Architecture and Design:STRATEGY::EFFECTIVENESS::DESCRIPTION:Prevention schemes mirror that of hard-coded password storage.::\nTAXONOMY NAME:CLASP:ENTRY NAME:Use of hard-coded cryptographic key::::TAXONOMY NAME:OWASP Top Ten 2007:ENTRY ID:A8:ENTRY NAME:Insecure Cryptographic Storage:MAPPING FIT:CWE More Specific::::TAXONOMY NAME:OWASP Top Ten 2007:ENTRY ID:A9:ENTRY NAME:Insecure Communications:MAPPING FIT:CWE More Specific::::TAXONOMY NAME:OWASP Top Ten 2004:ENTRY ID:A8:ENTRY NAME:Insecure Storage:MAPPING FIT:CWE More Specific::::TAXONOMY NAME:Software Fault Patterns:ENTRY ID:SFP33:ENTRY NAME:Hardcoded sensitive data::\nTYPE:Other:NOTE:The main difference between the use of hard-coded passwords and the use of hard-coded cryptographic keys is the false sense of security that the former conveys. Many people believe that simply hashing a hard-coded password before storage will protect the information from malicious users. However, many hashes are reversible (or at least vulnerable to brute force attacks) -- and further, many authentication protocols simply request the hash itself, making it no better than a password.::"));
    this.cweList.put(
        601,
        new CWE(
            601,
            "URL Redirection to Untrusted Site ('Open Redirect')",
            "Variant",
            "Draft",
            "A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.\nAn http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance.\n::NATURE:ChildOf:CWE ID:610:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:20:VIEW ID:699:ORDINAL:Primary::NATURE:ChildOf:CWE ID:20:VIEW ID:1003:ORDINAL:Primary::\n:::LANGUAGE CLASS:Language-Independent:LANGUAGE PREVALENCE:Undetermined::PARADIGN NAME:Web Based:PARADIGN PREVALENCE:Undetermined::\n::Phishing is a general term for deceptive attempts to coerce private information from users that will be used for identity theft.::\n::TERM:Open Redirect:DESCRIPTION:::TERM:Cross-site Redirect:DESCRIPTION:::TERM:Cross-domain Redirect:DESCRIPTION:::\n:::PHASE:Architecture and Design:DESCRIPTION::::PHASE:Implementation:DESCRIPTION:::\n::SCOPE:Access Control:TECHNICAL IMPACT:Bypass Protection Mechanism Gain Privileges or Assume Identity:NOTE:Access Control Bypass Protection Mechanism Gain Privileges or Assume Identity The user may be redirected to an untrusted page that contains malware which may then compromise the user's machine. This will expose the user to extensive risk and the user's interaction with the web server may also be compromised if the malware conducts keylogging or other attacks that steal credentials, personally identifiable information (PII), or other important data.::SCOPE:Access Control:SCOPE:Confidentiality:SCOPE:Other:TECHNICAL IMPACT:Bypass Protection Mechanism Gain Privileges or Assume Identity Other:NOTE:Access Control Confidentiality Other Bypass Protection Mechanism Gain Privileges or Assume Identity Other The user may be subjected to phishing attacks by being redirected to an untrusted page. The phishing attack may point to an attacker controlled web page that appears to be a trusted web site. The phishers may then steal the user's credentials and then use these credentials to access the legitimate web site.::\n::METHOD:Manual Static Analysis:EFFECTIVENESS:High:DESCRIPTION:Since this weakness does not typically appear frequently within a single software package, manual white box techniques may be able to provide sufficient code coverage and reduction of false positives if all potentially-vulnerable operations can be assessed within limited time constraints.::METHOD:Automated Dynamic Analysis:EFFECTIVENESS::DESCRIPTION:Automated black box tools that supply URLs to every input may be able to spot Location header modifications, but test case coverage is a factor, and custom redirects may not be detected.::METHOD:Automated Static Analysis:EFFECTIVENESS::DESCRIPTION:Automated static analysis tools may not be able to determine whether input influences the beginning of a URL, which is important for reducing false positives.::METHOD:Other:EFFECTIVENESS::DESCRIPTION:Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.::METHOD:Automated Static Analysis - Binary or Bytecode:EFFECTIVENESS:High:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis::METHOD:Dynamic Analysis with Automated Results Interpretation:EFFECTIVENESS:High:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Web Application Scanner Web Services Scanner Database Scanners::METHOD:Dynamic Analysis with Manual Results Interpretation:EFFECTIVENESS:High:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Fuzz Tester Framework-based Fuzzer::METHOD:Manual Static Analysis - Source Code:EFFECTIVENESS:High:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Manual Source Code Review (not inspections)::METHOD:Automated Static Analysis - Source Code:EFFECTIVENESS:High:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer::METHOD:Architecture or Design Review:EFFECTIVENESS:High:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)::\n::PHASE:Implementation:STRATEGY:Input Validation:EFFECTIVENESS::DESCRIPTION:Assume all input is malicious. Use an accept known good input validation strategy, i.e., use a whitelist of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, boat may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as red or blue. Do not rely exclusively on looking for malicious or malformed inputs (i.e., do not rely on a blacklist). A blacklist is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, blacklists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. Use a whitelist of approved URLs or domains to be used for redirection.::PHASE:Architecture and Design:STRATEGY::EFFECTIVENESS::DESCRIPTION:Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.::PHASE:Architecture and Design:STRATEGY:Enforcement by Conversion:EFFECTIVENESS::DESCRIPTION:When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to /login.asp and ID 2 could map to http://www.example.com/. Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.::PHASE:Architecture and Design:STRATEGY::EFFECTIVENESS::DESCRIPTION:Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).::PHASE:Architecture and Design Implementation:STRATEGY:Attack Surface Reduction:EFFECTIVENESS::DESCRIPTION:Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls. Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.::PHASE:Operation:STRATEGY:Firewall:EFFECTIVENESS:Moderate:DESCRIPTION:Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth.::\n::REFERENCE:CVE-2005-4206:DESCRIPTION:URL parameter loads the URL into a frame and causes it to appear to be part of a valid page.:LINK:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4206REFERENCE:CVE-2008-2951:DESCRIPTION:An open redirect vulnerability in the search script in the software allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL as a parameter to the proper function.:LINK:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2951REFERENCE:CVE-2008-2052:DESCRIPTION:Open redirect vulnerability in the software allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the proper parameter.:LINK:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2052\nTAXONOMY NAME:WASC:ENTRY ID:38:ENTRY NAME:URl Redirector Abuse::::TAXONOMY NAME:Software Fault Patterns:ENTRY ID:SFP24:ENTRY NAME:Tainted input to command::\n::194::"));
    this.cweList.put(
        650,
        new CWE(
            650,
            "Trusting HTTP Permission Methods on the Server Side",
            "Variant",
            "Incomplete",
            "The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.\nThe HTTP GET method and some other methods are designed to retrieve resources and not to alter the state of the application or resources on the server side. Furthermore, the HTTP specification requires that GET requests (and other requests) should not have side effects. Believing that it will be enough to prevent unintended resource alterations, an application may disallow the HTTP requests to perform DELETE, PUT and POST operations on the resource representation. However, there is nothing in the HTTP protocol itself that actually prevents the HTTP GET method from performing more than just query of the data. Developers can easily code programs that accept a HTTP GET request that do in fact create, update or delete data on the server. For instance, it is a common practice with REST based Web Services to have HTTP GET requests modifying resources on the server side. However, whenever that happens, the access control needs to be properly enforced in the application. No assumptions should be made that only HTTP DELETE, PUT, POST, and other methods have the power to alter the representation of the resource being accessed in the request.\n::NATURE:ChildOf:CWE ID:436:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:436:VIEW ID:699:ORDINAL:Primary::\n:::LANGUAGE CLASS:Language-Independent:LANGUAGE PREVALENCE:Undetermined::\n:::PHASE:Architecture and Design:DESCRIPTION::::PHASE:Implementation:DESCRIPTION::::PHASE:Operation:DESCRIPTION:::\n::SCOPE:Access Control:TECHNICAL IMPACT:Gain Privileges or Assume Identity:NOTE:Access Control Gain Privileges or Assume Identity An attacker could escalate privileges.::SCOPE:Integrity:TECHNICAL IMPACT:Modify Application Data:NOTE:Integrity Modify Application Data An attacker could modify resources.::SCOPE:Confidentiality:TECHNICAL IMPACT:Read Application Data:NOTE:Confidentiality Read Application Data An attacker could obtain sensitive information.::\n::PHASE:System Configuration:STRATEGY::EFFECTIVENESS::DESCRIPTION:Configure ACLs on the server side to ensure that proper level of access control is defined for each accessible resource representation.::\n"));
    this.cweList.put(
        326,
        new CWE(
            326,
            "Inadequate Encryption Strength",
            "Class",
            "Draft",
            "The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.\nA weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.\n::NATURE:ChildOf:CWE ID:693:VIEW ID:1000:ORDINAL:Primary::\n:::LANGUAGE CLASS:Language-Independent:LANGUAGE PREVALENCE:Undetermined::\n:::PHASE:Architecture and Design:DESCRIPTION:::\n::SCOPE:Access Control:SCOPE:Confidentiality:TECHNICAL IMPACT:Bypass Protection Mechanism Read Application Data:NOTE:Access Control Confidentiality Bypass Protection Mechanism Read Application Data An attacker may be able to decrypt the data using brute force attacks.::\n::PHASE:Architecture and Design:STRATEGY::EFFECTIVENESS::DESCRIPTION:Use a cryptographic algorithm that is currently considered to be strong by experts in the field.::\n::REFERENCE:CVE-2001-1546:DESCRIPTION:Weak encryption:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1546REFERENCE:CVE-2004-2172:DESCRIPTION:Weak encryption (chosen plaintext attack):LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2172REFERENCE:CVE-2002-1682:DESCRIPTION:Weak encryption:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1682REFERENCE:CVE-2002-1697:DESCRIPTION:Weak encryption produces same ciphertext from the same plaintext blocks.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1697REFERENCE:CVE-2002-1739:DESCRIPTION:Weak encryption:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1739REFERENCE:CVE-2005-2281:DESCRIPTION:Weak encryption scheme:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2281REFERENCE:CVE-2002-1872:DESCRIPTION:Weak encryption (XOR):LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1872REFERENCE:CVE-2002-1910:DESCRIPTION:Weak encryption (reversible algorithm).:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1910REFERENCE:CVE-2002-1946:DESCRIPTION:Weak encryption (one-to-one mapping).:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1946REFERENCE:CVE-2002-1975:DESCRIPTION:Encryption error uses fixed salt, simplifying brute force / dictionary attacks (overlaps randomness).:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1975\nTAXONOMY NAME:PLOVER:ENTRY NAME:Weak Encryption::::TAXONOMY NAME:OWASP Top Ten 2007:ENTRY ID:A8:ENTRY NAME:Insecure Cryptographic Storage:MAPPING FIT:CWE More Specific::::TAXONOMY NAME:OWASP Top Ten 2007:ENTRY ID:A9:ENTRY NAME:Insecure Communications:MAPPING FIT:CWE More Specific::::TAXONOMY NAME:OWASP Top Ten 2004:ENTRY ID:A8:ENTRY NAME:Insecure Storage:MAPPING FIT:CWE More Specific::\n::112::20::\nTYPE:Maintenance:NOTE:A variety of encryption algorithms exist, with various weaknesses. This category could probably be split into smaller sub-categories.::::TYPE:Maintenance:NOTE:Relationships between CWE-310, CWE-326, and CWE-327 and all their children need to be reviewed and reorganized.::"));
    this.cweList.put(
        760,
        new CWE(
            760,
            "Use of a One-Way Hash with a Predictable Salt",
            "Base",
            "Incomplete",
            "The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software uses a predictable salt as part of the input.\nThis makes it easier for attackers to pre-compute the hash value using dictionary attack techniques such as rainbow tables, effectively disabling the protection that an unpredictable salt would provide. It should be noted that, despite common perceptions, the use of a good salt with a hash does not sufficiently increase the effort for an attacker who is targeting an individual password, or who has a large amount of computing resources available, such as with cloud-based services or specialized, inexpensive hardware. Offline password cracking can still be effective if the hash function is not expensive to compute; many cryptographic functions are designed to be efficient and can be vulnerable to attacks using massive computing resources, even if the hash is cryptographically strong. The use of a salt only slightly increases the computing requirements for an attacker compared to other strategies such as adaptive hash functions. See CWE-916 for more details.\n::NATURE:ChildOf:CWE ID:916:VIEW ID:699:ORDINAL:Primary::NATURE:ChildOf:CWE ID:916:VIEW ID:1000:ORDINAL:Primary::\n::In cryptography, salt refers to some random addition of data to an input before hashing to make dictionary attacks more difficult.::\n:::PHASE:Implementation:DESCRIPTION:::\n::SCOPE:Access Control:TECHNICAL IMPACT:Bypass Protection Mechanism::\n::PHASE:Architecture and Design:STRATEGY::EFFECTIVENESS:High:DESCRIPTION:Use an adaptive hash function that can be configured to change the amount of computational effort needed to compute the hash, such as the number of iterations (stretching) or the amount of memory required. Some hash functions perform salting automatically. These functions can significantly increase the overhead for a brute force attack compared to intentionally-fast functions such as MD5. For example, rainbow table attacks can become infeasible due to the high computing overhead. Finally, since computing power gets faster and cheaper over time, the technique can be reconfigured to increase the workload without forcing an entire replacement of the algorithm in use. Some hash functions that have one or more of these desired properties include bcrypt [REF-291], scrypt [REF-292], and PBKDF2 [REF-293]. While there is active debate about which of these is the most effective, they are all stronger than using salts with hash functions with very little computing overhead. Note that using these functions can have an impact on performance, so they require special consideration to avoid denial-of-service attacks. However, their configurability provides finer control over how much CPU and memory is used, so it could be adjusted to suit the environment's needs.::PHASE:Implementation:STRATEGY::EFFECTIVENESS:Limited:DESCRIPTION:If a technique that requires extra computational effort can not be implemented, then for each password that is processed, generate a new random salt using a strong random number generator with unpredictable seeds. Add the salt to the plaintext password before hashing it. When storing the hash, also store the salt. Do not use the same salt for every password.::\n::REFERENCE:CVE-2008-4905:DESCRIPTION:Blogging software uses a hard-coded salt when calculating a password hash.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4905REFERENCE:CVE-2002-1657:DESCRIPTION:Database server uses the username for a salt when encrypting passwords, simplifying brute force attacks.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1657REFERENCE:CVE-2001-0967:DESCRIPTION:Server uses a constant salt when encrypting passwords, simplifying brute force attacks.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0967REFERENCE:CVE-2005-0408:DESCRIPTION:chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0408"));
    this.cweList.put(
        338,
        new CWE(
            338,
            "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
            "Base",
            "Draft",
            "The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.\nWhen a non-cryptographic PRNG is used in a cryptographic context, it can expose the cryptography to certain types of attacks. Often a pseudo-random number generator (PRNG) is not designed for cryptography. Sometimes a mediocre source of randomness is sufficient or preferable for algorithms that use random numbers. Weak generators generally take less processing power and/or do not use the precious, finite, entropy sources on a system. While such PRNGs might have very useful features, these same features could be used to break the cryptography.\n::NATURE:ChildOf:CWE ID:330:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:330:VIEW ID:699:ORDINAL:Primary::NATURE:ChildOf:CWE ID:330:VIEW ID:1003:ORDINAL:Primary::\n:::LANGUAGE CLASS:Language-Independent:LANGUAGE PREVALENCE:Undetermined::\n:::PHASE:Architecture and Design:DESCRIPTION::::PHASE:Implementation:DESCRIPTION:::\n::SCOPE:Access Control:TECHNICAL IMPACT:Bypass Protection Mechanism:NOTE:Access Control Bypass Protection Mechanism If a PRNG is used for authentication and authorization, such as a session ID or a seed for generating a cryptographic key, then an attacker may be able to easily guess the ID or cryptographic key and gain access to restricted functionality.::\n::PHASE:Implementation:STRATEGY::EFFECTIVENESS::DESCRIPTION:Use functions or hardware which use a hardware-based random number generation for all crypto. This is the recommended solution. Use CyptGenRandom on Windows, or hw_rand() on Linux.::\n::REFERENCE:CVE-2009-3278:DESCRIPTION:Crypto product uses rand() library function to generate a recovery key, making it easier to conduct brute force attacks.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3278REFERENCE:CVE-2009-3238:DESCRIPTION:Random number generator can repeatedly generate the same value.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3238REFERENCE:CVE-2009-2367:DESCRIPTION:Web application generates predictable session IDs, allowing session hijacking.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2367REFERENCE:CVE-2008-0166:DESCRIPTION:SSL library uses a weak random number generator that only generates 65,536 unique keys.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0166\nTAXONOMY NAME:CLASP:ENTRY NAME:Non-cryptographic PRNG::::TAXONOMY NAME:CERT C Secure Coding:ENTRY ID:MSC30-C:ENTRY NAME:Do not use the rand() function for generating pseudorandom numbers:MAPPING FIT:CWE More Abstract::"));
    this.cweList.put(
        297,
        new CWE(
            297,
            "Improper Validation of Certificate with Host Mismatch",
            "Variant",
            "Incomplete",
            "The software communicates with a host that provides a certificate, but the software does not properly ensure that the certificate is actually associated with that host.\nEven if a certificate is well-formed, signed, and follows the chain of trust, it may simply be a valid certificate for a different site than the site that the software is interacting with. If the certificate's host-specific data is not properly checked - such as the Common Name (CN) in the Subject or the Subject Alternative Name (SAN) extension of an X.509 certificate - it may be possible for a redirection or spoofing attack to allow a malicious host with a valid certificate to provide data, impersonating a trusted host. In order to ensure data integrity, the certificate must be valid and it must pertain to the site that is being accessed. Even if the software attempts to check the hostname, it is still possible to incorrectly check the hostname. For example, attackers could create a certificate with a name that begins with a trusted name followed by a NUL byte, which could cause some string-based comparisons to only examine the portion that contains the trusted name. This weakness can occur even when the software uses Certificate Pinning, if the software does not verify the hostname at the time a certificate is pinned.\n::NATURE:ChildOf:CWE ID:295:VIEW ID:1000::NATURE:ChildOf:CWE ID:295:VIEW ID:699:ORDINAL:Primary::NATURE:ChildOf:CWE ID:295:VIEW ID:1003:ORDINAL:Primary::NATURE:ChildOf:CWE ID:923:VIEW ID:1000:ORDINAL:Primary::\n:::LANGUAGE CLASS:Language-Independent:LANGUAGE PREVALENCE:Undetermined::PARADIGN NAME:Mobile:PARADIGN PREVALENCE:Undetermined::\n:::PHASE:Architecture and Design:DESCRIPTION::::PHASE:Implementation:DESCRIPTION:::\n::SCOPE:Access Control:TECHNICAL IMPACT:Gain Privileges or Assume Identity:NOTE:Access Control Gain Privileges or Assume Identity The data read from the system vouched for by the certificate may not be from the expected system.::SCOPE:Authentication:SCOPE:Other:TECHNICAL IMPACT:Other:NOTE:Authentication Other Other Trust afforded to the system in question - based on the malicious certificate - may allow for spoofing or redirection attacks.::\n::METHOD:Dynamic Analysis with Manual Results Interpretation:EFFECTIVENESS::DESCRIPTION:Set up an untrusted endpoint (e.g. a server) with which the software will connect. Create a test certificate that uses an invalid hostname but is signed by a trusted CA and provide this certificate from the untrusted endpoint. If the software performs any operations instead of disconnecting and reporting an error, then this indicates that the hostname is not being checked and the test certificate has been accepted.::METHOD:Black Box:EFFECTIVENESS::DESCRIPTION:When Certificate Pinning is being used in a mobile application, consider using a tool such as Spinner [REF-955]. This methodology might be extensible to other technologies.::\n::PHASE:Architecture and Design:STRATEGY::EFFECTIVENESS::DESCRIPTION:Fully check the hostname of the certificate and provide the user with adequate information about the nature of the problem and how to proceed.::PHASE:Implementation:STRATEGY::EFFECTIVENESS::DESCRIPTION:If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.::\n::REFERENCE:CVE-2012-5810:DESCRIPTION:Mobile banking application does not verify hostname, leading to financial loss.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5810REFERENCE:CVE-2012-5811:DESCRIPTION:Mobile application for printing documents does not verify hostname, allowing attackers to read sensitive documents.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5811REFERENCE:CVE-2012-5807:DESCRIPTION:Software for electronic checking does not verify hostname, leading to financial loss.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5807REFERENCE:CVE-2012-3446:DESCRIPTION:Cloud-support library written in Python uses incorrect regular expression when matching hostname.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3446REFERENCE:CVE-2009-2408:DESCRIPTION:Web browser does not correctly handle '0' character (NUL) in Common Name, allowing spoofing of https sites.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408REFERENCE:CVE-2012-0867:DESCRIPTION:Database program truncates the Common Name during hostname verification, allowing spoofing.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0867REFERENCE:CVE-2010-2074:DESCRIPTION:Incorrect handling of '0' character (NUL) in hostname verification allows spoofing.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2074REFERENCE:CVE-2009-4565:DESCRIPTION:Mail server's incorrect handling of '0' character (NUL) in hostname verification allows spoofing.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4565REFERENCE:CVE-2009-3767:DESCRIPTION:LDAP server's incorrect handling of '0' character (NUL) in hostname verification allows spoofing.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3767REFERENCE:CVE-2012-5806:DESCRIPTION:Payment processing module does not verify hostname when connecting to PayPal using PHP fsockopen function.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5806REFERENCE:CVE-2012-2993:DESCRIPTION:Smartphone device does not verify hostname, allowing spoofing of mail services.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2993REFERENCE:CVE-2012-5804:DESCRIPTION:E-commerce module does not verify hostname when connecting to payment site.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5804REFERENCE:CVE-2012-5824:DESCRIPTION:Chat application does not validate hostname, leading to loss of privacy.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5824REFERENCE:CVE-2012-5822:DESCRIPTION:Application uses third-party library that does not validate hostname.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5822REFERENCE:CVE-2012-5819:DESCRIPTION:Cloud storage management application does not validate hostname.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5819REFERENCE:CVE-2012-5817:DESCRIPTION:Java library uses JSSE SSLSocket and SSLEngine classes, which do not verify the hostname.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5817REFERENCE:CVE-2012-5784:DESCRIPTION:SOAP platform does not verify the hostname.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5784REFERENCE:CVE-2012-5782:DESCRIPTION:PHP library for payments does not verify the hostname.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5782REFERENCE:CVE-2012-5780:DESCRIPTION:Merchant SDK for payments does not verify the hostname.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5780REFERENCE:CVE-2003-0355:DESCRIPTION:Web browser does not validate Common Name, allowing spoofing of https sites.:LINK:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0355\nTAXONOMY NAME:CLASP:ENTRY NAME:Failure to validate host-specific certificate data::"));
  }

  /**
   * The lookup for the CWE
   *
   * <p>CWE_Lookup({@link java.lang.Integer})
   *
   * @param cweId {@link java.lang.Integer}
   * @return a {@link CWE_Reader.CWE} object.
   */
  public CWE CWE_Lookup(Integer cweId) {
    if (this.getCweList().containsKey(cweId)) return this.cweList.get(cweId);
    else return this.cweList.get(-1);
  }

  /**
   * Getter for the field <code>cweVersion</code>.
   *
   * @return a {@link java.lang.Double} object.
   */
  public Double getCweVersion() {
    return this.cweVersion;
  }
  //endregion

}
