Weakness (CWE)
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource.
How to prevent it (6 mitigations)
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
-
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
-
Implementation
Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile your product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-665
24 results · Clear filters · Feed
-
Low 3.7
Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.
An Improper Initialization vulnerability in the SSR software in Juniper Networks Session Smart Router allows an attacker to decrypt traffic or cause a denial of service via security policy assignment.
-
Low 3.1
Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization
A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be …
-
Low 1.3
AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3…
-
Low 1.7
filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the iden…
-
Low 1.8
Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause …
-
Low 3.3
Improper initialization for some ESXi kernel mode driver for the Intel(R) Ethernet 800-Series before version 2.2.2.0 (e…
-
Low 2.9
x86: incomplete IBPB for vCPU isolation
In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Conside…
-
Low 3.7
Open5GS PFCP handler.c ogs_pfcp_handle_create_pdr initialization
A vulnerability was found in Open5GS up to 2.7.5. Affected by this vulnerability is the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c of the component PFCP. The manipulation results in improper initialization. It is possible to launch …
-
Low 3.2
Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-S…
-
Low 3.3
Improper initialization in the Linux kernel-mode driver for some Intel(R) I350 Series Ethernet before version 5.19.2 ma…
-
Low 2.1
@misskey-dev/summaly Redirect Filter Bypass
@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn't…
-
Low 2.5
PyTorch Quantized Sigmoid Module nnq_Sigmoid initialization
A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zero_point leads to improper initializatio…
-
Low 2.3
Improper initialization in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privilege…
-
Low 3.4
Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before ver…
-
Low 2.3
Improper initialization in firmware for some Intel(R) CSME may allow a privileged user to potentially enable informatio…
-
Low 1.9
Improper Initialization for some Intel Unison software may allow a privileged user to potentially enable denial of serv…
-
Low 3.3
Improper initialization for some Intel Unison software may allow an authenticated user to potentially enable informatio…
-
Low 3.3
A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized…
-
Low 3.7
The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of A…
-
Low 2.6
Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to s…
-
Low 3.3
Dell Networking OS10 versions 10.4.3.x, 10.5.0.x and 10.5.1.x contain an information exposure vulnerability. A low priv…
-
Low 3.6
Invalid validation in `QuantizeAndDequantizeV2`
TensorFlow is an end-to-end open source platform for machine learning. The validation in `tf.raw_ops.QuantizeAndDequantizeV2` allows invalid values for `axis` argument:. The validation(https://github.com/tensorflow/tensorflow/blob/eccb7ec454e6617738554a255d77…
-
Low 3.6
Incomplete validation in `SparseReshape`
TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `SparseReshape` results in a denial of service based on a `CHECK`-failure. The implementation(https://github.com/tensorflow/tensorflow/blob/e87b51ce05c3eb172065a6e…
-
Low 2.3
Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and …