cve.bz

CWE-457: Use of Uninitialized Variable, page 6

Filter

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

What the weakness is: CWE-457 at MITRE

Ask an AI about CWE-457

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-457: Use of Uninitialized Variable and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/457.html and https://cve.bz/cve/cwe/457?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2024-26147EPSS 0.9%

    Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plug…

  2. 7.8CVE-2023-31275EPSS 1.7%

    An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file can lead to remote code execution. An attacker can provide a …

  3. 5.3CVE-2023-31192EPSS 1.0%

    An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-midd…

  4. 5.5CVE-2023-25588EPSS 0.4%

    A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service.

  5. 5.5CVE-2023-25586EPSS 0.3%

    A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.

  6. 5.5CVE-2023-25585EPSS 0.4%

    A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service.

  7. 9.8CVE-2022-40510EPSS 0.4%

    Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.

  8. 7.5CVE-2022-25737EPSS 0.4%

    Information disclosure in modem due to missing NULL check while reading packets received from local network

  9. 4.4CVE-2022-42432EPSS 0.7%

    This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to e…

  10. 7.8CVE-2022-28320EPSS 0.9%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open …

  11. 7.8CVE-2022-28319EPSS 0.9%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicio…

  12. 7.8CVE-2022-28317EPSS 0.6%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a maliciou…

  13. 7.8CVE-2022-34390EPSS 0.2%

    Dell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

  14. 6.5CVE-2022-2308EPSS 0.2%

    A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismat…

  15. 4.4CVE-2022-33716EPSS 0.10%

    An absence of variable initialization in ICCC TA prior to SMR Aug-2022 Release 1 allows local attacker to read uninitialized memory.

  16. 7.5CVE-2022-34655EPSS 0.8%

    In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel…

  17. 7.8CVE-2021-46631EPSS 2.0%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a …

  18. 7.8CVE-2021-46617EPSS 2.0%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious…

  19. 7.8CVE-2021-46570EPSS 2.1%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or…

  20. 7.8CVE-2021-46566EPSS 2.0%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious…

  21. 5.3CVE-2021-21966EPSS 1.4%

    An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A specially-crafted HTTP request can lead to an uninitialized read. An attacker can sen…

  22. 9.8CVE-2022-21217EPSS 1.2%

    An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to an out-of-bounds write. An attacker can send an HTTP request to trig…

  23. 9.8CVE-2021-40418EPSS 18%

    When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUID that was parsed from a frame within the video container. U…

  24. 5.5CVE-2021-44003EPSS 0.8%

    A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to use of uninitialized memory while parsing user supplied TIFF files. This cou…

  25. 8.1CVE-2021-41253EPSS 1.9%

    Zydis is an x86/x86-64 disassembler library. Users of Zydis versions v3.2.0 and older that use the string functions provided in `zycore` in order to append untrusted user data to the formatter buffer within their custom formatter hooks can…

  26. 7.8CVE-2021-3928EPSS 0.6%

    vim is vulnerable to Use of Uninitialized Variable

  27. 7.8CVE-2021-31435EPSS 2.8%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…

  28. 5.5CVE-2019-1010319EPSS 1.5%

    WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously c…

  29. 5.5CVE-2019-1010317EPSS 1.5%

    WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously craft…

  30. 5.3CVE-2019-11038EPSS 4.3%

    When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that w…

  31. 7.5CVE-2011-0539EPSS 1.8%

    The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the nonce field, which might allow remote attackers to obtain sen…

  32. 8.8CVE-2009-0901EPSS 37%

    The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP…