Weakness (CWE)
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource.
How to prevent it (6 mitigations)
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
-
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
-
Implementation
Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile your product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-665
178 results · Feed
-
Medium —
ArrayQueue's push_front is not panic-safe
The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument. Specifically, `push_front` receives an argument that is intended to be cloned and push…
-
Medium —
IdMap from_iter may lead to uninitialized memory being freed on drop
Due to a flaw in the constructor `id_map::IdMap::from_iter`, ill-formed objects may be created in which the amount of actually initialized memory is less than what is expected by the fields of `IdMap`. Specifically, the field `ids` is initialized based on the…
-
Low 3.3
Improper initialization in the Linux kernel-mode driver for some Intel(R) I350 Series Ethernet before version 5.19.2 ma…
-
Medium 4.2
ThirdPartyVideo SetVariable Vulnerability
AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Successful exploitation of this vulnerability may leave the resource in an unexpected state and potentially impact confidentiality, integrity, and…
-
Medium 5.6
The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to ve…
-
Medium 5.6
The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vec…
-
Medium 4.1
Improper initialization in the UEFI firmware for the Intel(R) Server D50DNP and M50FCP boards may allow a privileged us…
-
Low 2.1
@misskey-dev/summaly Redirect Filter Bypass
@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn't…
-
Low 2.5
PyTorch Quantized Sigmoid Module nnq_Sigmoid initialization
A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zero_point leads to improper initializatio…
-
Medium 5.5
An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_A…
-
Medium 5.3
Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to…
-
Low 2.3
Improper initialization in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privilege…
-
Medium 5.9
Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw durin…
-
High 8.5
Rockwell Automation Arena® Uninitialized Vulnerability
An “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to access a variable before it being initialized. If exploited, a threat actor could l…
-
Critical 9.2
Improper Initialization of `imc` Scheme Leading to `SIGABRT` in ION-DTN BPv7
The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A vulnerability exists in the version ION-DTN BPv7 implementation version 4.1.3 when receiving a bundle with an improper reference to the imc s…
-
Low 3.4
Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before ver…
-
High 7.5
Unbounded allocation in ctl(4) CAM Target Layer
The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch(1) to pass the filename to the library was incorrect, in effect ignoring the option. Fetch wou…
-
High 8.8
Improper initialization in the Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters bef…
-
Low 2.3
Improper initialization in firmware for some Intel(R) CSME may allow a privileged user to potentially enable informatio…
-
Medium 6.5
Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, al…
-
Medium 4.6
Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR17, 4.0.0 SR07, 4.1.0 SR04, 4.2.0 SR04, and 4.3.0 SR02 fail…
-
Critical 9.4
Symantec Privileged Access Manager Remote Command Execution vulnerability
An improper input validation allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request.
-
Medium 5.7
Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated ma…
-
Critical 9.8
Apache CloudStack: Integration API service uses dynamic port when disabled
The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port global setting) for internal portal integrations and for testing purposes. By default, the integrat…
-
High 7.8
CVE
NVIDIA GPU Display Driver for Windows contains a vulnerability where the information from a previous client or another process could be disclosed. A successful exploit of this vulnerability might lead to code execution, information disclosure, or data tamperi…
-
Medium 5.5
Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user…
-
High 7.8
Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability
Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute l…
-
High 7.8
Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability
Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute l…
-
High 7.8
Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability
Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute l…
-
High 7.5
p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon crash) or po…
-
Medium 5.0
Improper initialization in some Intel(R) MAS software before version 2.3 may allow an authenticated user to potentially…
-
Medium 4.3
Improper initialization for the Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 m…
-
Medium 6.1
Improper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 …
-
Medium 6.8
Eap-galleon: custom provisioning creates unsecured http-invoker
An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.
-
High 7.8
Improper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE b…
-
Medium 6.5
Improper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow an authenticated user to potent…
-
High 8.8
Improper initialization in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to pot…
-
Low 1.9
Improper Initialization for some Intel Unison software may allow a privileged user to potentially enable denial of serv…
-
Low 3.3
Improper initialization for some Intel Unison software may allow an authenticated user to potentially enable informatio…
-
High 7.5CVE-2023-1719 Scanner template
Bitrix24 Insecure Global Variable Extraction
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitra…