Weakness (CWE)
CWE-824: Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
More detail
If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks.
Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.
Source: MITRE CWE-824
233 results · Feed
-
High 7.1
Reference binding to nullptr in `MatrixDiagV*` ops in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixDiagV*`. The [implementation](https://gith…
-
High 7.1
Reference binding to nullptr in `MatrixSetDiagV*` ops in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixSetDiagV*`. The [implementation](https://g…
-
Unscored —
An uninitialized pointer in FATEK Automation FvDesigner, Versions 1.5.88 and prior may be exploited while the applicati…
-
Unscored —
A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library lacks pro…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
High 7.8
Phoenix Contact: Automation Worx Software Suite affected by Remote Code Execution (RCE) vulnerability
Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of in…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Deskt…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
-
Unscored —
A CWE-824: Access of uninitialized pointer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior tha…
-
Low 2.5
Reference binding to null in `ParameterizedTruncatedNormal`
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger undefined behavior by binding to null pointer in `tf.raw_ops.ParameterizedTruncatedNormal`. This is because the implementation(https://github.com/tensorflow/tensorf…
-
High 7.8
ArcGIS general raster security update: uninitialized pointer
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution i…
-
Medium 6.4
ArcGIS Server image service and raster analytics security update: uninitialized pointer
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service acc…
-
Unscored —
An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is process…
-
Unscored —
An uninitialized pointer issue has been identified in the way the application processes project files, allowing an atta…
-
Medium 6.5
Junos OS Evolved: Receipt of certain valid BGP update packets from BGP peers may cause RPD to core when using REGEX.
In Juniper Networks Junos OS Evolved an attacker sending certain valid BGP update packets may cause Junos OS Evolved to access an uninitialized pointer causing RPD to core leading to a Denial of Service (DoS). Continued receipt of these types of valid BGP upd…
-
Unscored —
A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this…
-
Medium 5.9
Bitdefender ceva_emu.cvd module denial-of-service (VA-8766)
A vulnerability has been discovered in the ceva_emu.cvd module that results from a lack of proper validation of user-supplied data, which can result in a pointer that is fetched from uninitialized memory. This can lead to denial-of-service. This issue affects…
-
Critical 9.8
Access of Uninitialized Pointer in linked-hash-map
An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust. It creates an uninitialized NonNull pointer, which violates a non-null constraint.
-
Critical 9.8
Asyncpg Arbitrary Code Execution Via Access to an Uninitialized Pointer
asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.
-
Unscored —
Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited…
-
Medium 6.5
An exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A s…
-
High 7.8CVE-2020-8882 EPSS 11%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
Unscored —
In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Are…
-
High 8.6
Cisco StarOS Denial of Service Vulnerability
A vulnerability in the internal packet-processing functionality of the Cisco StarOS operating system running on virtual platforms could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of …
-
Unscored —
An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusio…
-
Unscored —
mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLR
mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLR. ASLR is an exploit mitigation technique used by modern Windows platforms. For ASLR to function, Windows executables must contain a relocations table…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.…
-
Unscored —
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reade…
-
High 8.8
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office docume…
KEV Mar 28, 2022 -
Medium 5.3
The ipfw firewall in FreeBSD 6.0-RELEASE allows remote attackers to cause a denial of service (firewall crash) via ICMP…