Weakness (CWE)
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource.
How to prevent it (6 mitigations)
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
-
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
-
Implementation
Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile your product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-665
67 results · Clear filters · Feed
-
Medium 6.5
Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string …
-
Medium 5.3
MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharing…
-
Medium 5.3
Suricata smtp/mime: incomplete state reset allows detection bypass
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822…
-
Medium 4.3
Improper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web orig…
-
Medium 5.9
Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention
The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-filled static struct k_mutex credential_lock; and never called k_mutex_init() on it. A statically zero-…
-
Medium 5.6
Improper initialization in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT), and some Intel(…
-
Medium 5.3
Quicly is vulnerable to stateless reset injection
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dccf5d4, Quicly was vulnerable to stateless reset injection through lack of packet entry validation. The QUIC protocol is designed to withsta…
-
Medium 6.5
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffi…
-
Medium 5.1
Docker Sandboxes ICMP egress restriction bypass after daemon restart
Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A work…
-
Medium 5.6
Improper initialization in the UEFI firmware for some Intel platforms within Ring 0: Bare Metal OS may allow an informa…
-
Medium 4.0
iccDEV: DoS in CIccCLUT::Iterate() & CIccMBB::Describe()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate() and output produced by CIccMBB::Describe() (via CLUT dumping). T…
-
Medium 6.7
A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local p…
-
Medium 4.4
Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical acce…
-
Medium —
ArrayQueue's push_front is not panic-safe
The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument. Specifically, `push_front` receives an argument that is intended to be cloned and push…
-
Medium —
IdMap from_iter may lead to uninitialized memory being freed on drop
Due to a flaw in the constructor `id_map::IdMap::from_iter`, ill-formed objects may be created in which the amount of actually initialized memory is less than what is expected by the fields of `IdMap`. Specifically, the field `ids` is initialized based on the…
-
Medium 4.2
ThirdPartyVideo SetVariable Vulnerability
AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Successful exploitation of this vulnerability may leave the resource in an unexpected state and potentially impact confidentiality, integrity, and…
-
Medium 5.6
The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to ve…
-
Medium 5.6
The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vec…
-
Medium 4.1
Improper initialization in the UEFI firmware for the Intel(R) Server D50DNP and M50FCP boards may allow a privileged us…
-
Medium 5.5
An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_A…
-
Medium 5.3
Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to…
-
Medium 5.9
Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw durin…
-
Medium 6.5
Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, al…
-
Medium 4.6
Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR17, 4.0.0 SR07, 4.1.0 SR04, 4.2.0 SR04, and 4.3.0 SR02 fail…
-
Medium 5.7
Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated ma…
-
Medium 5.5
Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user…
-
Medium 5.0
Improper initialization in some Intel(R) MAS software before version 2.3 may allow an authenticated user to potentially…
-
Medium 4.3
Improper initialization for the Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 m…
-
Medium 6.1
Improper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 …
-
Medium 6.8
Eap-galleon: custom provisioning creates unsecured http-invoker
An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.
-
Medium 6.5
Improper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow an authenticated user to potent…
-
Medium 6.3
Malicious image running containers may cause DoS attacks
iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.
-
Medium 6.5
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.
-
Medium 6.0
Improper initialization in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable informatio…
-
Medium 6.0
Improper initialization in some Intel(R) NUC 13 Extreme Compute Element, Intel(R) NUC 13 Extreme Kit, Intel(R) NUC 11 P…
-
Medium 6.1
Improper initialization in BIOS firmware for some Intel(R) NUCs may allow a privileged user to potentially enable infor…
-
Medium 6.1
Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially en…
-
Medium 5.3
Improper sanitization of MXCSR and RFLAGS in OpenEnclave
Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as Enclaves. There are two issues that are mitigated in version 0.19.3. First, Open Enclave SDK does not…
-
Medium 4.0
Improper initialization for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable informati…
-
Medium 5.5
WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.