cve.bz

CWE-665: Improper Initialization, page 5

Filter

The product does not initialize or incorrectly initializes a resource.

What the weakness is: CWE-665 at MITRE. All weaknesses

Related attack patterns (CAPEC): 2
  • CAPEC-26 Leveraging Race Conditions Likelihood: High · Severity: High
  • CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-665, as MITRE names them. Credits.

Ask an AI about CWE-665

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-665: Improper Initialization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/665.html and https://cve.bz/cve/cwe/665?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2020-28019EPSS 62%

    Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA.

  2. 5.8CVE-2021-0234EPSS 0.9%

    Due to an improper Initialization vulnerability on Juniper Networks Junos OS QFX5100-96S devices with QFX 5e Series image installed, ddos-protection configuration changes will not take effect beyond the default DDoS (Distributed Denial of …

  3. 7.5CVE-2021-0226EPSS 0.9%

    On Juniper Networks Junos OS Evolved devices, receipt of a specific IPv6 packet may cause an established IPv6 BGP session to terminate, creating a Denial of Service (DoS) condition. Continued receipt and processing of this packet will crea…

  4. 7.5CVE-2021-0435EPSS 1.7%

    In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed fo…

  5. 6.5CVE-2021-28688EPSS 0.3%

    The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in ne…

  6. 4.4CVE-2021-1780EPSS 0.3%

    A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 14.4 and iPadOS 14.4. An attacker in a privileged position may be able to perform a denial of service attack.

  7. 5.3CVE-2020-25578EPSS 2.3%

    In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 several file systems were not properly initializing the d_off field of the dirent structures retu…

  8. 4.5CVE-2020-35508EPSS 0.2%

    A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to …

  9. 9.8CVE-2019-10196EPSS 1.4%

    A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all…

  10. 7.8CVE-2020-26886EPSS 0.6%

    Softaculous before 5.5.7 is affected by a code execution vulnerability because of External Initialization of Trusted Variables or Data Stores. This leads to privilege escalation on the local host.

  11. 4.4CVE-2021-0453EPSS 0.1%

    In the Titan-M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitatio…

  12. 4.4CVE-2021-0452EPSS 0.1%

    In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitatio…

  13. 4.4CVE-2021-0451EPSS 0.1%

    In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitatio…

  14. 4.4CVE-2021-0450EPSS 0.1%

    In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitatio…

  15. 4.4CVE-2021-0449EPSS 0.1%

    In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitatio…

  16. 4.4CVE-2020-0522EPSS 0.2%

    Improper initialization in the firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may allow a privileged user to potentially enable denial of service via local access.

  17. 7.8CVE-2021-1661EPSS 0.8%

    Windows Installer Elevation of Privilege Vulnerability

  18. 7.8CVE-2020-10143EPSS 0.6%

    Macrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\openssl\. Macrium Reflect contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectorie…

  19. 6.5CVE-2020-26957EPSS 0.6%

    OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. *Note: This issue only affected Firefox for Android. Other operating …

  20. 5.5CVE-2020-27950KEVEPSS 17%

    A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.…

  21. 6.0CVE-2020-26933EPSS 0.3%

    Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shut-down that uses USE_DA_USED. Improper initialization of th…

  22. 5.5CVE-2020-12326EPSS 0.3%

    Improper initialization in some Intel(R) Thunderbolt(TM) DCH drivers for Windows* before version 72 may allow an authenticated user to potentially enable information disclosure via local access.

  23. 7.8CVE-2020-8744EPSS 0.4%

    Improper initialization in subsystem for Intel(R) CSME versions before12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE versions before 4.0.30 Intel(R) SPS versions before E3_05.01.04.200 may allow a privileged user to potentia…

  24. 6.5CVE-2020-0450EPSS 0.9%

    In rw_i93_sm_format of rw_i93.cc, there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure over NFC with no additional execution privileges needed. User interaction is needed for ex…

  25. 7.8CVE-2020-3573EPSS 2.8%

    Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation…

  26. 6.5CVE-2020-25662EPSS 1.2%

    A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memory when handling certain AMP packets. This flaw allows a remote attacker in an ad…

  27. 7.8CVE-2020-9863EPSS 1.4%

    A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. An application may be able to execute arbitrary code with kerne…

  28. 7.8CVE-2020-10139EPSS 0.4%

    Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis True Image contains a privileged service that uses this OpenSSL component. Because unprivileged…

  29. 7.8CVE-2020-10138EPSS 0.5%

    Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis Cyber Backup and Cyber Protect contain a privileged service that uses thi…

  30. 5.0CVE-2020-16901EPSS 1.5%

    <p>An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.</p> <p>To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who …

  31. 5.5CVE-2020-9964EPSS 0.4%

    A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 14.0 and iPadOS 14.0. A local user may be able to read kernel memory.

  32. 6.5CVE-2020-0414EPSS 1.0%

    In AudioFlinger::RecordThread::threadLoop of audioflinger/Threads.cpp, there is a possible non-silenced audio buffer due to a permissions bypass. This could lead to remote information disclosure with no additional execution privileges need…

  33. 4.4CVE-2019-14556EPSS 0.3%

    Improper initialization in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow a privileged user to potentially enable denial of service via local access.

  34. 4.4CVE-2020-1592EPSS 1.2%

    <p>An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.</p> <p>To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who …

  35. 7.8CVE-2020-24996EPSS 1.1%

    There is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftohtml binary, which allows a remote attacker to cau…

  36. 8.2CVE-2020-12301EPSS 0.4%

    Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.

  37. 7.1CVE-2020-8918EPSS 0.2%

    An improperly initialized 'migrationAuth' value in Google's go-tpm TPM1.2 library versions prior to 0.3.0 can lead an eavesdropping attacker to discover the auth value for a key created with CreateWrapKey. An attacker listening in on the c…

  38. 5.5CVE-2020-14347EPSS 0.4%

    A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-serv…

  39. 5.5CVE-2020-1389EPSS 1.3%

    An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1367, CVE-2020-1419, CVE-2…

  40. 7.5CVE-2020-4067EPSS 1.9%

    In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to …

  41. 7.8CVE-2020-0586EPSS 0.4%

    Improper initialization in subsystem for Intel(R) SPS versions before SPS_E3_04.01.04.109.0 and SPS_E3_04.08.04.070.0 may allow an authenticated user to potentially enable escalation of privilege and/or denial of service via local access.

  42. 7.8CVE-2020-0529EPSS 0.4%

    Improper initialization in BIOS firmware for 8th, 9th and 10th Generation Intel(R) Core(TM) Processor families may allow an unauthenticated user to potentially enable escalation of privilege via local access.

  43. 5.5CVE-2020-9833EPSS 0.3%

    A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.5. A local user may be able to read kernel memory.

  44. 7.5CVE-2020-3811EPSS 1.8%

    qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.

  45. 7.7CVE-2020-10725EPSS 2.2%

    A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests runni…

  46. 7.5CVE-2020-11655EPSS 4.3%

    SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

  47. 7.5CVE-2020-1617EPSS 1.6%

    This issue occurs on Juniper Networks Junos OS devices which do not support Advanced Forwarding Interface (AFI) / Advanced Forwarding Toolkit (AFT). Devices using AFI and AFT are not exploitable to this issue. An improper initialization of…

  48. 5.3CVE-2020-9775EPSS 0.9%

    An issue existed in the handling of tabs displaying picture in picture video. The issue was corrected with improved state handling. This issue is fixed in iOS 13.4 and iPadOS 13.4. A user's private browsing activity may be unexpectedly sav…

  49. 7.8CVE-2020-3919EPSS 1.4%

    A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. A malicious application may be able to execute arbitrary code with …

  50. 7.2CVE-2019-7630EPSS 3.1%

    An issue was discovered in gdrv.sys in Gigabyte APP Center before 19.0227.1. The vulnerable driver exposes a wrmsr instruction via IOCTL 0xC3502580 and does not properly filter the target Model Specific Register (MSR). Allowing arbitrary M…