Weakness (CWE)
CWE-242: Use of Inherently Dangerous Function
The product calls a function that can never be guaranteed to work safely, regardless of how it is used.
How to prevent it (2 mitigations)
-
Build and Compilation, Implementation
Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's SDL. [REF-554] [REF-1009] [REF-7]
-
Testing
Use grep or static analysis tools to spot usage of dangerous functions.
Source: MITRE CWE-242
2 results · Clear filters · Feed
-
Critical 9.8
Ruijie Reyee OS Use of Inherently Dangerous Function
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands.
-
Critical 9.8
modulemd uses an unsafe function for processing externally provided data
modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.