CWE-665: Improper Initialization, page 3
Filter
The product does not initialize or incorrectly initializes a resource.
What the weakness is: CWE-665 at MITRE. All weaknesses
Related attack patterns (CAPEC): 2
- CAPEC-26 Leveraging Race Conditions Likelihood: High · Severity: High
- CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-665, as MITRE names them. Credits.
Ask an AI about CWE-665
Show the prompt
Explain CWE-665: Improper Initialization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/665.html and https://cve.bz/cve/cwe/665?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.8CVE-2023-40596EPSS 0.2%
In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and s…
- 7.5CVE-2020-35342EPSS 0.8%
GNU Binutils before 2.34 has an uninitialized-heap vulnerability in function tic4x_print_cond (file opcodes/tic4x-dis.c) which could allow attackers to make an information leak.
- 5.3CVE-2023-40349EPSS 0.7%
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.
- 4.4CVE-2023-27887EPSS 0.2%
Improper initialization in BIOS firmware for some Intel(R) NUCs may allow a privileged user to potentially enable information disclosure via local access.
- 4.4CVE-2023-22444EPSS 0.2%
Improper initialization in some Intel(R) NUC 13 Extreme Compute Element, Intel(R) NUC 13 Extreme Kit, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Performance Mini PC, Intel(R) NUC Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC…
- 4.4CVE-2023-22356EPSS 0.2%
Improper initialization in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access.
- 4.4CVE-2022-38083EPSS 0.2%
Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
- 7.1CVE-2023-31926EPSS 0.2%
System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.
- 5.9CVE-2023-3242EPSS 0.5%
Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions.
- 7.5CVE-2023-37479EPSS 0.7%
Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as Enclaves. There are two issues that are mitigated in version 0.19.3. First, Open …
- 5.5CVE-2022-48518EPSS 0.1%
Vulnerability of signature verification in the iaware system being initialized later than the time when the system broadcasts are sent. Successful exploitation of this vulnerability may cause malicious apps to start upon power-on by spoofi…
- 4.4CVE-2022-31477EPSS 0.2%
Improper initialization for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access.
- 8.8CVE-2023-27934EPSS 1.8%
A memory initialization issue was addressed. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. A remote attacker may be able to cause unexpected app termination or arbitrary code execution.
- 7.8CVE-2023-25010EPSS 0.3%
A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code execution.
- 7.5CVE-2022-48352EPSS 0.5%
Some smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic.
- 3.3CVE-2023-1513EPSS 0.2%
A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.
- 3.7CVE-2023-26084EPSS 0.4%
The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected data, leading to a man-in-the-middle attack. This occurs because of an improperly initialized variable.
- 5.5CVE-2023-27115EPSS 0.3%
WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.
- 5.5CVE-2021-22283EPSS 0.2%
Improper Initialization vulnerability in ABB Relion protection relays - 611 series, ABB Relion protection relays - 615 series IEC 4.0 FP1, ABB Relion protection relays - 615 series CN 4.0 FP1, ABB Relion protection relays - 615 series IEC …
- 7.8CVE-2023-1048EPSS 0.6%
A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5. This issue affects some unknown processing in the library WinRing0x64.sys. The manipulation leads to improper initialization. L…
- 7.8CVE-2023-1047EPSS 0.4%
A vulnerability classified as critical was found in TechPowerUp RealTemp 3.7.0.0. This vulnerability affects unknown code in the library WinRing0x64.sys. The manipulation leads to improper initialization. An attack has to be approached loc…
- 6.5CVE-2021-3329EPSS 0.6%
Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack
- 7.8CVE-2022-34153EPSS 0.2%
Improper initialization in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 6.7CVE-2022-32231EPSS 0.2%
Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- 6.7CVE-2022-30704EPSS 0.2%
Improper initialization in the Intel(R) TXT SINIT ACM for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- 7.5CVE-2023-23555EPSS 0.6%
On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1.5.0 to before 1.6.0, when FastL4 profile is configured on a virtual server, undi…
- 6.5CVE-2023-0397EPSS 0.5%
A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.
- 7.5CVE-2022-46505EPSS 0.9%
An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that can decrypt secret data.
- 5.4CVE-2023-22466EPSS 0.6%
Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `f…
- 7.4CVE-2022-3259EPSS 0.6%
Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.
- 7.5CVE-2022-43468EPSS 0.9%
External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a re…
- 9.8CVE-2022-46164EPSS 47%
NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerabi…
- 7.8CVE-2022-37334EPSS 0.2%
Improper initialization in BIOS firmware for some Intel(R) NUC 11 Pro Kits and Intel(R) NUC 11 Pro Boards before version TNTGL357.0064 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 5.6CVE-2022-39384EPSS 0.7%
OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may …
- 4.3CVE-2022-39284EPSS 1.1%
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erro…
- 5.5CVE-2022-32823EPSS 0.2%
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be…
- 5.5CVE-2022-2472EPSS 0.3%
Improper Initialization vulnerability in the local server component of EZVIZ CS-C6N-A0-1C2WFR allows a local attacker to read the contents of the memory space containing the encrypted admin password. This issue affects: EZVIZ CS-C6N-A0-1C2…
- 9.8CVE-2022-36061EPSS 1.3%
Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.35, read only calls between contracts can generate smart contracts results. For example, if contract A calls in read only mode contract B and the …
- 9.8CVE-2022-37128EPSS 22%
In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.
- 5.5CVE-2021-4218EPSS 0.3%
A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This flaw allows a local attacker with local access to cause a denial of service while the system reboots…
- 7.2CVE-2022-32579EPSS 0.3%
Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of privilege via physical access.
- 7.8CVE-2022-27493EPSS 0.2%
Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable an escalation of privilege via local access.
- 5.5CVE-2022-24378EPSS 0.2%
Improper initialization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable denial of service via local access.
- 7.8CVE-2021-23223EPSS 0.3%
Improper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
- 8.8CVE-2022-2620EPSS 0.7%
Use after free in WebUI in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.
- 8.8CVE-2022-36364EPSS 3.2%
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiati…
- 7.5CVE-2022-29695EPSS 1.1%
Unicorn Engine v2.0.0-rc7 contains memory leaks caused by an incomplete unicorn engine initialization.
- 7.8CVE-2022-26722EPSS 0.8%
A memory initialization issue was addressed. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to gain root privileges.
- 7.8CVE-2022-26721EPSS 0.9%
A memory initialization issue was addressed. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to gain root privileges.
- 9.8CVE-2022-0947EPSS 0.9%
A vulnerability in ABB ARG600 Wireless Gateway series that could allow an attacker to exploit the vulnerability by remotely connecting to the serial port gateway, and/or protocol converter, depending on the configuration.