cve.bz

CWE-242: Use of Inherently Dangerous Function

Filter

The product calls a function that can never be guaranteed to work safely, regardless of how it is used.

What the weakness is: CWE-242 at MITRE. All weaknesses

Ask an AI about CWE-242

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-242: Use of Inherently Dangerous Function and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/242.html and https://cve.bz/cve/cwe/242?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.3CVE-2026-11980EPSS 0.2%

    IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.

  2. 8.8CVE-2026-6477EPSS 0.5%

    Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-lar…

  3. 7.8CVE-2025-1994EPSS 0.2%

    IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the BinaryFormatter function.

  4. 8.8CVE-2025-49215EPSS 0.3%

    A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low…

  5. 7.8CVE-2025-1331EPSS 0.3%

    IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the gets function.

  6. 9.2CVE-2024-52324EPSS 0.7%

    Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands.

  7. 7.4CVE-2021-40698EPSS 0.6%

    ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass  . An authenticated attacker could leverage …

  8. 8.8CVE-2022-36310EPSS 1.6%

    Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other Ai…

  9. 7.8CVE-2021-42543EPSS 0.8%

    The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown.

  10. 9.8CVE-2017-1002157EPSS 2.9%

    modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.

  11. 8.1CVE-2017-0904EPSS 2.4%

    The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private ne…