CWE-665: Improper Initialization, page 2
Filter
The product does not initialize or incorrectly initializes a resource.
What the weakness is: CWE-665 at MITRE. All weaknesses
Related attack patterns (CAPEC): 2
- CAPEC-26 Leveraging Race Conditions Likelihood: High · Severity: High
- CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-665, as MITRE names them. Credits.
Ask an AI about CWE-665
Show the prompt
Explain CWE-665: Improper Initialization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/665.html and https://cve.bz/cve/cwe/665?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.5CVE-2024-11158EPSS 0.2%
An “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to access a variable before it being initialized. If exploited…
- 9.2CVE-2024-54129EPSS 0.4%
The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A vulnerability exists in the version ION-DTN BPv7 implementation version 4.1.3 when receiving a bundle with an improper re…
- 4.6CVE-2024-25563EPSS 0.2%
Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before version 23.40 may allow a privileged user to potentially enable information disclosure via local access.
- 7.5CVE-2024-45289EPSS 0.3%
The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch(1) to pass the filename to the library was incorrect, in effect ignoring …
- 5.5CVE-2024-46697EPSS 0.4%
In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure that nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to checking for the security label, then args.co…
- 5.5CVE-2024-45018EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: initialise extack before use Fix missing initialisation of extack in flow offload.
- 5.5CVE-2024-44947EPSS 0.9%
In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate fuse_notify_store(), unlike fuse_do_readpage(), does not enable page zeroing (because it can be used to…
- 9.3CVE-2024-21807EPSS 0.2%
Improper initialization in the Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 4.6CVE-2023-48361EPSS 0.2%
Improper initialization in firmware for some Intel(R) CSME may allow a privileged user to potentially enable information disclosure via local access.
- 10.0CVE-2023-20591EPSS 0.3%
Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker to read or modify hypervisor memory, potentially resulting in loss of confidentiality, integrity, and…
- 6.8CVE-2023-40261EPSS 0.4%
Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR17, 4.0.0 SR07, 4.1.0 SR04, 4.2.0 SR04, and 4.3.0 SR02 fails to validate file attributes during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attac…
- 5.5CVE-2024-42078EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: nfsd: initialise nfsd_info.mutex early. nfsd_info.mutex can be dereferenced by svc_pool_stats_start() immediately after the new netns is created. Currently this can tri…
- 9.4CVE-2024-36455EPSS 0.5%
An improper input validation allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request.
- 8.2CVE-2023-32467EPSS 0.2%
Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some UEFI code, le…
- 9.8CVE-2024-39864EPSS 1.8%
The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port global setting) for internal portal integrations and for testing purposes. By d…
- 5.5CVE-2024-39485EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Properly re-initialise notifier entry in unregister The notifier_entry of a notifier is not re-initialised after unregistering the notifier. This lead…
- 5.5CVE-2024-39301EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: net/9p: fix uninit-value in p9_client_rpc() Syzbot with the help of KMSAN reported the following error: BUG: KMSAN: uninit-value in trace_9p_client_res include/trace/ev…
- 5.5CVE-2024-38558EPSS 0.8%
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple for ICMPv6 OVS_PACKET_CMD_EXECUTE has 3 main attributes: - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format…
- 7.8CVE-2024-0089EPSS 0.2%
NVIDIA GPU Display Driver for Windows contains a vulnerability where the information from a previous client or another process could be disclosed. A successful exploit of this vulnerability might lead to code execution, information disclos…
- 5.5CVE-2024-32930EPSS 0.08%
In plugin_ipc_handler of slc_plugin.c, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure of 4 bytes of stack memory with no additional execution privileges needed. User in…
- 5.9CVE-2024-32916EPSS 0.08%
In fvp_freq_histogram_init of fvp.c, there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for e…
- 5.5CVE-2023-45315EPSS 0.2%
Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user to potentially enable denial of service via local access.
- 6.5CVE-2024-22064EPSS 0.5%
ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE) with the mobile devices connecting over …
- 7.8CVE-2023-27325EPSS 0.4%
Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the …
- 7.8CVE-2023-27324EPSS 0.4%
Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the …
- 7.8CVE-2023-27322EPSS 0.4%
Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the …
- 7.8CVE-2021-47194EPSS 0.3%
In the Linux kernel, the following vulnerability has been resolved: cfg80211: call cfg80211_stop_ap when switch from P2P_GO type If the userspace tools switch from NL80211_IFTYPE_P2P_GO to NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SE…
- 7.5CVE-2024-28084EPSS 0.9%
p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact because of initialization issues in situations where parsing of advertised service …
- 5.5CVE-2021-46932EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: Input: appletouch - initialize work before device registration Syzbot has reported warning in __flush_work(). This warning is caused by work->func == NULL, which means m…
- 7.8CVE-2023-52452EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit stack slots Privileged programs are supposed to be able to read uninitialized stack memory (ever since 6715df8d5) but, before this patch, the…
- 5.5CVE-2023-36490EPSS 0.2%
Improper initialization in some Intel(R) MAS software before version 2.3 may allow an authenticated user to potentially enable denial of service via local access.
- 2.3CVE-2023-35061EPSS 0.4%
Improper initialization for the Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
- 6.5CVE-2023-28720EPSS 0.4%
Improper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticated user to potentially enable denial of service via adjacent access..
- 7.5CVE-2023-4503EPSS 0.7%
An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available fro…
- 7.8CVE-2022-46487EPSS 0.6%
Improper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for Intel SGX allows a local attacker to compromise the execution integrity of floating-point operations in …
- 3.3CVE-2023-45085EPSS 0.2%
An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous s…
- 7.5CVE-2023-49062EPSS 0.6%
Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet generation. After a bpf_xdp_adjust_head call, Katran code didn’t initialize the Identifi…
- 7.8CVE-2023-28737EPSS 0.2%
Improper initialization in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable escalation of privilege via local access.
- 5.5CVE-2023-27306EPSS 0.2%
Improper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow an authenticated user to potentially enable denial of service via local access.
- 4.4CVE-2022-46301EPSS 0.2%
Improper Initialization for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access.
- 5.5CVE-2022-45109EPSS 0.2%
Improper initialization for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access.
- 9.8CVE-2023-1719ExploitEPSS 6.3%
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and poss…
- 6.5CVE-2021-33638EPSS 0.2%
When the isula cp command is used to copy files from a container to a host machine and the container is controlled by an attacker, the attacker can escape the container.
- 6.5CVE-2021-33637EPSS 0.2%
When the isula export command is used to export a container to an image and the container is controlled by an attacker, the attacker can escape the container.
- 7.8CVE-2021-33636EPSS 0.3%
When the isula load command is used to load malicious images, attackers can execute arbitrary code.
- 7.8CVE-2021-33635EPSS 0.6%
When malicious images are pulled by isula pull, attackers can execute arbitrary code.
- 5.5CVE-2021-33634EPSS 0.2%
iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.
- 5.5CVE-2023-5370EPSS 0.2%
On CPU 0 the check for the SMCCC workaround is called before SMCCC support has been initialized. This resulted in no speculative execution workarounds being installed on CPU 0.
- 5.5CVE-2023-20597EPSS 0.2%
Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.
- 4.4CVE-2023-20594EPSS 0.2%
Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.