CWE-908: Use of Uninitialized Resource, page 16

The product uses or accesses a resource that has not been initialized.

What the weakness is: CWE-908 at MITRE

1. 7.8CVE-2021-0530EPSS 0.1%2021-06-21

   In memory management driver, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio…

2. 7.8CVE-2021-0526EPSS 0.1%2021-06-21

   In memory management driver, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio…

3. 7.8CVE-2021-0495EPSS 0.1%2021-06-11

   In memory management driver, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio…

4. 8.8CVE-2021-0473EPSS 0.5%2021-06-11

   In rw_t3t_process_error of rw_t3t.cc, there is a possible double free due to uninitialized data. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitat…

5. 8.4CVE-2020-11260EPSS 0.2%2021-06-09

   An improper free of uninitialized memory can occur in DIAG services in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile

6. 6.5CVE-2021-3545EPSS 0.4%2021-06-02

   An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could …

7. 9.8CVE-2018-25014EPSS 2.2%2021-05-21

   A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

8. 5.5CVE-2021-29581EPSS 0.2%2021-05-14

   TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.CTCBeamSearchDecoder`, an attacker can trigger denial of service via segmentation faults. The implementation(https://github.com…

9. 5.5CVE-2021-29580EPSS 0.2%2021-05-14

   TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FractionalMaxPoolGrad` triggers an undefined behavior if one of the input tensors is empty. The code is also vulnerable to a denial of…

10. 3.3CVE-2021-29623EPSS 1.1%2021-05-13

    Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and…

11. 6.0CVE-2021-31423EPSS 0.4%2021-04-29

    This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the ability to execute high-privileged code on the target guest system i…

12. 6.5CVE-2021-31419EPSS 0.4%2021-04-29

    This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first obtain the ability to execute low-privileged code on the target guest system in…

13. 6.5CVE-2021-31418EPSS 0.4%2021-04-29

    This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first obtain the ability to execute low-privileged code on the target guest system in…

14. 6.5CVE-2021-31417EPSS 0.4%2021-04-29

    This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first obtain the ability to execute low-privileged code on the target guest system in…

15. 5.5CVE-2021-30027EPSS 0.7%2021-04-29

    md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malformed Markdown document.

16. 5.5CVE-2021-21218EPSS 1.3%2021-04-26

    Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.

17. 9.8CVE-2021-29937EPSS 1.4%2021-04-01

    An issue was discovered in the telemetry crate through 2021-02-17 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc::vec_with_size().

18. 9.8CVE-2021-29936EPSS 1.4%2021-04-01

    An issue was discovered in the adtensor crate through 2021-01-11 for Rust. There is a drop of uninitialized memory via the FromIterator implementation for Vector and Matrix.

19. 7.3CVE-2021-29934EPSS 0.9%2021-04-01

    An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.

20. 5.5CVE-2021-0463EPSS 0.1%2021-03-10

    In convertToHidl of convert.cpp, there is a possible out of bounds read due to uninitialized data from ReturnFrameworkMessage. This could lead to local information disclosure with no additional execution privileges needed. User interaction…

21. 8.8CVE-2021-21190EPSS 1.5%2021-03-09

    Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.

22. 9.8CVE-2021-28035EPSS 1.3%2021-03-05

    An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a drop of uninitialized memory can occur upon a val.clone() panic.

23. 9.8CVE-2021-28033EPSS 1.3%2021-03-05

    An issue was discovered in the byte_struct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics.

24. 7.5CVE-2021-28030EPSS 1.2%2021-03-05

    An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.

25. 7.5CVE-2021-28029EPSS 1.2%2021-03-05

    An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.

26. 7.5CVE-2021-26953EPSS 1.5%2021-02-09

    An issue was discovered in the postscript crate before 0.14.0 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via a user-provided Read implementation.

27. 7.5CVE-2021-26952EPSS 1.6%2021-02-09

    An issue was discovered in the ms3d crate before 0.1.3 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via IoReader::read.

28. 9.8CVE-2021-26951EPSS 1.7%2021-02-09

    An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-prov…

29. 9.8CVE-2021-26305EPSS 1.7%2021-01-29

    An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.

30. 9.1CVE-2021-25905EPSS 1.7%2021-01-26

    An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory.

31. 7.8CVE-2020-36210EPSS 0.4%2021-01-26

    An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption.

32. 6.5CVE-2020-16042EPSS 1.1%2021-01-08

    Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

33. 6.1CVE-2020-35494EPSS 1.1%2021-01-04

    There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower t…

34. 7.5CVE-2020-35893EPSS 1.4%2020-12-31

    An issue was discovered in the simple-slab crate before 0.3.3 for Rust. remove() has an off-by-one error, causing memory leakage and a drop of uninitialized memory.

35. 9.8CVE-2020-35888EPSS 1.5%2020-12-31

    An issue was discovered in the arr crate through 2020-08-25 for Rust. Uninitialized memory is dropped by Array::new_from_template.

36. 9.8CVE-2020-35878EPSS 1.5%2020-12-31

    An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of the dropping of uninitialized memory.

37. 5.3CVE-2020-26266EPSS 0.3%2020-12-10

    In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to defa…

38. 3.3CVE-2020-26271EPSS 0.2%2020-12-10

    In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge between one output tensor of the src nod…

39. 3.3CVE-2020-29371EPSS 0.7%2020-11-28

    An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.

40. 6.2CVE-2020-16985EPSS 1.7%2020-11-11

    Azure Sphere Information Disclosure Vulnerability

41. 5.5CVE-2020-15989EPSS 1.1%2020-11-03

    Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.

42. 7.8CVE-2020-16932EPSS 4.8%2020-10-16

    <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of t…

43. 7.8CVE-2020-16931EPSS 4.8%2020-10-16

    <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of t…

44. 6.5CVE-2020-0411EPSS 0.9%2020-10-14

    In ~AACExtractor() of AACExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for expl…

45. 4.3CVE-2020-17482EPSS 2.6%2020-10-02

    An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory.

46. 7.5CVE-2020-26148EPSS 1.4%2020-09-30

    md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial of service (e.g., assertion failure) via a malformed Markdown document.

47. 7.1CVE-2020-15193EPSS 0.8%2020-09-25

    In Tensorflow before versions 2.2.1 and 2.3.1, the implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory corruption. This is because the pybind11 glue code assumes that the argument is a t…

48. 6.7CVE-2020-0326EPSS 0.1%2020-09-18

    In NFC, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: …

49. 7.5CVE-2020-0300EPSS 0.8%2020-09-18

    In NFC, there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVers…

50. 4.4CVE-2020-0272EPSS 0.1%2020-09-18

    In libhwbinder, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges required. User interaction is not needed for exploitation.Product: Andro…