Weakness (CWE)
CWE-676: Use of Potentially Dangerous Function
The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
How to prevent it (1 mitigation)
-
Build and Compilation, Implementation
Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's SDL. [REF-554] [REF-1009] [REF-7]
Source: MITRE CWE-676
12 results · Feed
-
High 8.6
vsDesk Task Scheduler OS Command Injection
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operati…
-
Medium 4.3
Use of Potentially Dangerous Functionthat in IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions.
-
High 7.5
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) b…
-
Medium 6.2
FastNetMon Community Edition through 1.2.9 has a buffer overflow, a different vulnerability than CVE-2026-48686 and CVE…
-
Medium 5.2
A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.…
-
High 7.4
AVEVA Process Optimization Use of Potentially Dangerous Function
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a victim user who subsequently interacts with the graphical eleme…
-
Medium 5.5
Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2. I…
-
Medium 6.5
Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function
Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature bypass
-
Medium 4.0
Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. If this vulnerability is exploited…
-
Medium 6.7
Pillow buffer overflow vulnerability
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
-
Unscored —
When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session …
-
Critical 10.0
Rockwell Automation FactoryTalk AssetCentre Use of Potentially Dangerous Function
Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to IIS remoting services. This vulnerability may allow a remote, unauthenticated attacker to modify sensitive data in FactoryTalk AssetCentre.