var search = (module.exports.search = function search(object, path, action) {
  if (typeof path === "string") {
    path = path.split(".");
  }

  if (!(path instanceof Array) || path.length === 0) {
    return;
  }

  path = path.slice();

  var key = path.shift();

  if (typeof object !== "object" || object === null) {
    return;
  }

  if (key === "*") {
    key = ".*";
  }

  if (typeof key === "string") {
    key = new RegExp(key);
  }

  if (path.length === 0) {
    return Object.keys(object)
      .filter(key.test.bind(key))
      .map(function (k) {
        var value = object[k];
        if (action) {
          action(value, object, k);
        }
        return value;
      });
  } else {
    return Array.prototype.concat.apply(
      [],
      Object.keys(object)
        .filter(key.test.bind(key))
        .map(function (k) {
          return search(object[k], path, action);
        })
    );
  }
});
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.