Weakness (CWE)
CWE-457: Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
How to prevent it (5 mitigations)
-
Implementation
Ensure that critical variables are initialized before first use [REF-1485].
-
Build and Compilation
Most compilers will complain about the use of uninitialized variables if warnings are turned on.
-
Implementation, Operation
When using a language that does not require explicit declaration of variables, run or compile the software in a mode that reports undeclared or unknown variables. This may indicate the presence of a typographic error in the variable's name.
-
Requirements
Choose a language that is not susceptible to these issues.
-
Architecture and Design
Mitigating technologies such as safe string libraries and container abstractions could be introduced.
Source: MITRE CWE-457
297 results · Feed
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation …
-
High 7.8
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View …
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation …
-
Medium 5.3
An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 …
-
Critical 9.1
An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_201211…
-
High 7.5
Use of Uninitialized Resource in smallvec
An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.
-
Critical 9.8CVE-2021-40418 EPSS 18%
When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assi…
-
Unscored —
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2…
-
Medium 5.9
Possible heap buffer overflow when using zycore string functions in formatter hooks
Zydis is an x86/x86-64 disassembler library. Users of Zydis versions v3.2.0 and older that use the string functions provided in `zycore` in order to append untrusted user data to the formatter buffer within their custom formatter hooks can run into heap buffe…
-
High 7.3
Use of Uninitialized Variable in vim/vim
vim is vulnerable to Use of Uninitialized Variable
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
Unscored —
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flo…
-
Unscored —
WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flo…
-
Low 3.1
Uninitialized read in gdImageCreateFromXbm
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the functi…
-
High 7.5
The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t …
-
High 8.8CVE-2009-0901 EPSS 37%
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and V…