CWE-665: Improper Initialization, page 8

The product does not initialize or incorrectly initializes a resource.

What the weakness is: CWE-665 at MITRE. All weaknesses

1. 5.5CVE-2017-0735EPSS 0.3%2017-08-09

   A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38239864.

2. 7.8CVE-2017-0723EPSS 1.3%2017-08-09

   A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37968755.

3. 6.5CVE-2017-10972EPSS 2.3%2017-07-06

   Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.

4. 7.0CVE-2017-8576EPSS 1.2%2017-06-29

   The graphics component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel mode via a specially crafted application, aka "Microsoft Graphics Component Ele…

5. 5.5CVE-2017-0641EPSS 1.7%2017-06-14

   A remote denial of service vulnerability in libvpx in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of se…

6. 7.8CVE-2014-9942EPSS 0.5%2017-06-06

   In Boot in all Android releases from CAF using the Linux kernel, a Use of Uninitialized Variable vulnerability could potentially exist.

7. 6.5CVE-2017-3820EPSS 2.8%2017-02-03

   A vulnerability in Simple Network Management Protocol (SNMP) functions of Cisco ASR 1000 Series Aggregation Services Routers running Cisco IOS XE Software Release 3.13.6S, 3.16.2S, or 3.17.1S could allow an authenticated, remote attacker t…

8. 7.5CVE-2016-9446EPSS 3.6%2017-01-23

   The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render c…

9. 6.0CVE-2016-6836EPSS 0.4%2016-12-10

   The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object.

10. –CVE-2014-4371EPSS 0.4%2014-09-18

    The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted applicati…

11. –CVE-2014-0178EPSS 4.5%2014-05-28

    Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users t…

12. 7.5CVE-2011-4087EPSS 2.7%2013-06-08

    The br_parse_ip_options function in net/bridge/br_netfilter.c in the Linux kernel before 2.6.39 does not properly initialize a certain data structure, which allows remote attackers to cause a denial of service by leveraging connectivity to…

13. 6.5CVE-2013-1675KEVEPSS 6.7%2013-05-16

    Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNew…

14. –CVE-2012-0012EPSS 16%2012-02-14

    Microsoft Internet Explorer 9 does not properly handle the creation and initialization of string objects, which allows remote attackers to read data from arbitrary process-memory locations via a crafted web site, aka "Null Byte Information…

15. –CVE-2011-3927EPSS 1.4%2012-01-24

    Skia, as used in Google Chrome before 16.0.912.77, does not perform all required initialization of values, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

16. 5.5CVE-2010-4655EPSS 0.4%2011-07-18

    net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability for a…

17. 5.5CVE-2010-4343EPSS 0.4%2010-12-29

    drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.

18. 8.8CVE-2008-3637EPSS 5.7%2008-09-26

    The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11, 10.5.4, and 10.5.5 uses an uninitialized variable, which allows remote attackers to execute arbitrary code via a crafted applet, related to an "e…

19. 9.8CVE-2008-0062EPSS 10%2008-03-19

    KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL poi…

20. 7.8CVE-2007-3749EPSS 0.5%2007-11-15

    The kernel in Apple Mac OS X 10.4 through 10.4.10 does not reset the current Mach Thread Port or Thread Exception Port when executing a setuid program, which allows local users to execute arbitrary code by creating the port before launchin…

21. 8.8CVE-2001-1471ExploitEPSS 7.7%2001-07-31

    prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being pro…

22. –CVE-1999-0993EPSS 7.1%1999-12-13

    Modifications to ACLs (Access Control Lists) in Microsoft Exchange 5.5 do not take effect until the directory store cache is refreshed.