cve.bz

CWE-908: Use of Uninitialized Resource, page 13

Filter

The product uses or accesses a resource that has not been initialized.

What the weakness is: CWE-908 at MITRE

Ask an AI about CWE-908

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-908: Use of Uninitialized Resource and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/908.html and https://cve.bz/cve/cwe/908?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2024-26788EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: init irq after reg initialization Initialize the qDMA irqs after the registers are configured so that interrupts that may have been pending from a p…

  2. 5.5CVE-2024-26711EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4130: zero-initialize clock init data The clk_init_data struct does not have all its members initialized, causing issues when trying to expose the internal c…

  3. 5.5CVE-2024-26644EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to snapshot deleted subvolume If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the…

  4. 5.5CVE-2021-47139EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: hns3: put off calling register_netdev() until client initialize complete Currently, the netdevice is registered before client initializing complete. So there is a t…

  5. 5.5CVE-2021-47136EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: net: zero-initialize tc skb extension on allocation Function skb_ext_add() doesn't initialize created skb extension with any value and leaves it up to the user. However,…

  6. 7.8CVE-2024-1848EPSS 0.3%

    Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in SOLIDWORKS D…

  7. 5.5CVE-2024-26641EPSS 0.6%

    In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and…

  8. 4.4CVE-2024-26638EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: nbd: always initialize struct msghdr completely syzbot complains that msg->msg_get_inq value can be uninitialized [1] struct msghdr got many new fields recently, we sho…

  9. 7.1CVE-2021-47101EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: asix: fix uninit-value in asix_mdio_read() asix_read_cmd() may read less than sizeof(smsr) bytes and in this case smsr will be uninitialized. Fail log: BUG: KMSAN: unin…

  10. 4.0CVE-2021-47096EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ALSA: rawmidi - fix the uninitalized user_pversion The user_pversion was uninitialized for the user space file structure in the open function, because the file private s…

  11. 5.5CVE-2023-52577EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: dccp: fix dccp_v4_err()/dccp_v6_err() again dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr", not in the "byte 7" as Jann claimed. We need to make sure the I…

  12. 5.5CVE-2023-52528EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg syzbot reported the following uninit-value access issue: ============================================…

  13. 5.5CVE-2021-47056EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown() before calling adf_iov_putm…

  14. 7.8CVE-2024-1847EPSS 0.3%

    Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings fr…

  15. 7.5CVE-2024-21502EPSS 1.0%

    Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as user-defined type. Depending on the variab…

  16. 7.8CVE-2024-23137EPSS 1.0%

    A maliciously crafted STP or SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, can lead to code execution in the current p…

  17. 7.5CVE-2024-26147EPSS 0.9%

    Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plug…

  18. 7.5CVE-2024-23314EPSS 0.5%

    When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not eval…

  19. 5.5CVE-2024-20694EPSS 0.9%

    Windows CoreMessaging Information Disclosure Vulnerability

  20. 7.2CVE-2023-42797EPSS 0.5%

    A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V05.20). The network configuration service of affected devices contains a flaw in the conversion of i…

  21. 9.8CVE-2023-4489EPSS 0.5%

    The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing netw…

  22. 5.3CVE-2023-36012EPSS 2.0%

    DHCP Server Service Information Disclosure Vulnerability

  23. 7.8CVE-2023-31275EPSS 1.7%

    An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file can lead to remote code execution. An attacker can provide a …

  24. 5.5CVE-2023-46100EPSS 0.2%

    in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource.

  25. 8.8CVE-2023-38151EPSS 1.8%

    Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability

  26. 6.5CVE-2023-36398EPSS 0.8%

    Windows NTFS Information Disclosure Vulnerability

  27. 5.5CVE-2023-45663EPSS 0.7%

    stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a specified number of bytes from context (typically a file) into the specified buffer. In case the file stream points to the end, it retur…

  28. 5.3CVE-2023-31192EPSS 1.0%

    An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-midd…

  29. 5.5CVE-2023-36713EPSS 7.3%

    Windows Common Log File System Driver Information Disclosure Vulnerability

  30. 7.8CVE-2023-36704EPSS 0.8%

    Windows Setup Files Cleanup Remote Code Execution Vulnerability

  31. 7.5CVE-2023-36567EPSS 2.1%

    Windows Deployment Services Information Disclosure Vulnerability

  32. 5.5CVE-2023-25588EPSS 0.4%

    A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service.

  33. 5.5CVE-2023-25586EPSS 0.3%

    A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.

  34. 5.5CVE-2023-25585EPSS 0.4%

    A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service.

  35. 5.5CVE-2023-38140EPSS 1.1%

    Windows Kernel Information Disclosure Vulnerability

  36. 5.5CVE-2023-21276EPSS 0.10%

    In writeToParcel of CursorWindow.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for …

  37. 7.5CVE-2023-21233EPSS 0.4%

    In multiple locations of avrc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitatio…

  38. 4.4CVE-2023-22330EPSS 0.2%

    Use of uninitialized resource in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access.

  39. 7.5CVE-2023-36913EPSS 1.7%

    Microsoft Message Queuing Information Disclosure Vulnerability

  40. 5.5CVE-2023-3488EPSS 0.3%

    Uninitialized buffer in GBL parser in Silicon Labs GSDK v4.3.0 and earlier allows attacker to leak data from Secure stack via malformed GBL file.

  41. 4.7CVE-2023-36836EPSS 0.2%

    A Use of an Uninitialized Resource vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial of Service (DoS). On all …

  42. 5.5CVE-2021-0948EPSS 0.09%

    The PVRSRVBridgeGetMultiCoreInfo ioctl in the PowerVR kernel driver can return uninitialized kernel memory to user space. The contents of this memory could contain sensitive information.

  43. 5.5CVE-2023-35326EPSS 0.5%

    Windows CDP User Components Information Disclosure Vulnerability

  44. 7.5CVE-2023-35325EPSS 1.8%

    Windows Print Spooler Information Disclosure Vulnerability

  45. 7.5CVE-2023-32042EPSS 1.3%

    OLE Automation Information Disclosure Vulnerability

  46. 5.5CVE-2023-32041EPSS 0.6%

    Windows Update Orchestrator Service Information Disclosure Vulnerability

  47. 7.5CVE-2023-35847EPSS 0.7%

    VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero).

  48. 5.5CVE-2023-2747EPSS 0.2%

    The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized.

  49. 8.8CVE-2023-21127EPSS 0.5%

    In readSampleData of NuMediaExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitat…

  50. 5.5CVE-2023-32016EPSS 0.7%

    Windows Installer Information Disclosure Vulnerability