Weakness (CWE)
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource.
How to prevent it (6 mitigations)
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
-
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
-
Implementation
Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile your product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-665
57 results · Clear filters · Feed
-
High 7.8
Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged …
-
High 7.8
Improper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user…
-
High 8.8
Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lea…
-
High 7.2
Junos OS: EX4650 Series: Certain traffic received by the Junos OS device on the management interface may be forwarded to egress interfaces instead of discarded
Due to an Improper Initialization vulnerability in Juniper Networks Junos OS on EX4650 devices, packets received on the management interface (em0) but not destined to the device, may be improperly forwarded to an egress interface, instead of being discarded. …
-
High 7.8
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in co…
KEV Apr 25, 2022 -
High 7.5
Improper Initialization in OpenZeppelin
In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it …
-
High 7.0
Unchecked Class Instantiation when providing Plugin Classes
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc…
-
High 7.5
Junos OS: PTX Series, QFX10K Series: Upon receipt of specific packets BFD sessions might flap due to DDoS policer implementation in Packet Forwarding Engine
Due to an Improper Initialization vulnerability in Juniper Networks Junos OS on PTX platforms and QFX10K Series with Paradise (PE) chipset-based line cards, ddos-protection configuration changes made from the CLI will not take effect as expected beyond the de…
-
High 7.1
Interpreter crash from `tf.io.decode_raw`
TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.io.decode_raw` produces incorrect results and crashes the Python interpreter when combining `fixed_length` and wider datatypes. The implementation of the padded v…
-
High 7.1
Junos OS Evolved: The IPv6 BGP session will flap due to receipt of a specific IPv6 packet
On Juniper Networks Junos OS Evolved devices, receipt of a specific IPv6 packet may cause an established IPv6 BGP session to terminate, creating a Denial of Service (DoS) condition. Continued receipt and processing of this packet will create a sustained Denia…
-
High 7.0
Improper Initialization in coturn
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query …
-
High 7.7
A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vho…
-
High 7.5
Junos OS: PTX1000 and PTX10000 Series, QFX10000 Series using non-AFT architectures: A specific genuine packet inspected by sFlow will cause a reboot.
This issue occurs on Juniper Networks Junos OS devices which do not support Advanced Forwarding Interface (AFI) / Advanced Forwarding Toolkit (AFT). Devices using AFI and AFT are not exploitable to this issue. An improper initialization of memory in the packe…
-
High 8.1
Code execution vulnerability in HtmlUnit
HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specif…
-
High 8.6
Cisco Prime Network Registrar Denial of Service Vulnerability
A vulnerability in the DHCPv6 input packet processor of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to restart the server and cause a denial of service (DoS) condition on the affected system. The vulnerability is due to incom…
-
High 8.5
A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its inte…
-
High 7.8
A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the pre…