Weakness (CWE)
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it (4 mitigations)
-
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile the product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-908
551 results · Feed
-
High 7.5
Microsoft Office Excel Remote Code Execution Vulnerability
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft Office Word Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Windows Kernel Transaction Manager Information Disclosure Vulnerability
Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.
-
High 7.5
Windows Hyper-V Elevation of Privilege Vulnerability
Use of uninitialized resource in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows NTFS Elevation of Privilege Vulnerability
Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Windows Installer Information Disclosure Vulnerability
Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a network.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
-
Medium 6.6
Windows Smart Card Elevation of Privilege Vulnerability
Use of uninitialized resource in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.
-
High 7.5
Microsoft Office Word Remote Code Execution Vulnerability
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.5
Microsoft Office Outlook Remote Code Execution Vulnerability
Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
Medium 6.5
Windows Advanced Rasterization Platform Information Disclosure Vulnerability
Use of uninitialized resource in Windows Advanced Rasterization Platform allows an authorized attacker to disclose information locally.
-
Medium 5.5
Mailslot File System Information Disclosure Vulnerability
Use of uninitialized resource in Mailslot File System allows an authorized attacker to disclose information locally.
-
Medium 5.9
ASP.NET Core Information Disclosure Vulnerability
Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network.
-
High 7.5
Windows DNS Remote Code Execution Vulnerability
Use of uninitialized resource in Windows DNS allows an unauthorized attacker to execute code over an adjacent network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 5.5
Windows Broker Infrastructure Service Information Disclosure Vulnerability
Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally.
-
Medium 5.6
Windows Text Services Framework Information Disclosure Vulnerability
Use of uninitialized resource in Windows Text Services Framework allows an authorized attacker to disclose information locally.
-
Medium 5.5
Win32k Information Disclosure Vulnerability
Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Graphics Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
High 7.0
Microsoft ActiveX Installer Service Elevation of Privilege Vulnerability
Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally.
-
Medium 5.6
Microsoft Windows Codecs Library Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Windows Codecs Library allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Graphics Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
-
Medium 4.7
Windows Graphics Kernel Information Disclosure Vulnerability
Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Kernel Transaction Manager Information Disclosure Vulnerability
Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
Use of uninitialized resource in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally.
-
Medium 4.8
Use of uninitialized resource in the MigTD memory for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hy…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had c…
-
Medium 4.7
Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside …
-
Medium 4.7
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outsid…
-
High 7.5
Information Disclosure in SAP NetWeaver (SAP Message Server)
SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a…
-
Medium 4.3
Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This r…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeigh…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-…
-
Low 2.5
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via ADPCM_MS Trellis Encoding
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this en…
-
Low 3.3
FFmpeg through 9.0.2 Heap Memory Disclosure via DXA Decoder Uninitialized Buffer
FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized …
-
Low 3.3
FFmpeg 6.1 through 9.0.2 Information Disclosure via CamStudio Decoder cscd.c
FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c) that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a crafted AVI with a CS…
-
Low 3.3
FFmpeg through 9.0.2 Heap Memory Disclosure via VQA Video Decoder
FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Memory Read in Flash Screen Video 2 Decoder
FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decode_hybrid() in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated d…