CWE-908 · Use of Uninitialized Resource (page 6)
Page 6 of 9 — CVEs classified under CWE-908, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32041 | Medium | 5.5 | 2023-07-11 | Windows Update Orchestrator Service Information Disclosure Vulnerability |
CVE-2023-35847 | High | 7.5 | 2023-06-19 | VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero). |
CVE-2023-2747 | Low | 3.1 | 2023-06-15 | The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized. |
CVE-2023-21127 | High | 8.8 | 2023-06-15 | In readSampleData of NuMediaExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This could lead to remote code execution with no… |
CVE-2023-32016 | Medium | 5.5 | 2023-06-14 | Windows Installer Information Disclosure Vulnerability |
CVE-2023-29367 | High | 7.8 | 2023-06-14 | iSCSI Target WMI Provider Remote Code Execution Vulnerability |
CVE-2023-32213 | High | 8.8 | 2023-06-02 | When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird… |
CVE-2023-24941 | Critical | 9.8 | 2023-05-09 | Windows Network File System Remote Code Execution Vulnerability |
CVE-2023-28967 | High | 7.5 | 2023-04-17 | A Use of Uninitialized Resource vulnerability in the Border Gateway Protocol (BGP) software of Juniper Networks Junos OS and Junos OS Evolved allows an unauthe… |
CVE-2022-25737 | High | 7.5 | 2023-04-13 | Information disclosure in modem due to missing NULL check while reading packets received from local network |
CVE-2023-22897 | Medium | 6.5 | 2023-04-12 | An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information disclosure of memory contents to be achiev… |
CVE-2023-24886 | High | 8.8 | 2023-04-11 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability |
CVE-2023-27598 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed `Via` header to OpenSIPS triggers… |
CVE-2023-23413 | High | 8.8 | 2023-03-14 | Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability |
CVE-2021-32846 | High | 7.7 | 2023-02-17 | HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `virtio-sock` can lead… |
CVE-2021-32845 | High | 7.7 | 2023-02-17 | HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at… |
CVE-2023-22281 | High | 7.5 | 2023-02-01 | On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP AFM NAT pol… |
CVE-2022-47012 | High | 7.5 | 2023-01-20 | Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21. |
CVE-2023-21753 | Medium | 5.5 | 2023-01-10 | Event Tracing for Windows Information Disclosure Vulnerability |
CVE-2022-31741 | High | 8.8 | 2022-12-22 | A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability a… |
CVE-2020-36617 | Medium | 4.6 | 2022-12-18 | A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file… |
CVE-2022-2950 | High | 7.8 | 2022-12-13 | Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of H3D files. A DWORD… |
CVE-2022-2949 | High | 7.8 | 2022-12-13 | Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of H3D files. A DWORD… |
CVE-2022-32616 | Medium | 6.7 | 2022-11-08 | In isp, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-32615 | Medium | 6.7 | 2022-11-08 | In ccd, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-39283 | Medium | 5.9 | 2022-10-12 | FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized d… |
CVE-2022-39282 | Low | 3.5 | 2022-10-12 | FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitial… |
CVE-2022-34390 | High | 7.5 | 2022-10-12 | Dell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an S… |
CVE-2022-40768 | Medium | 5.5 | 2022-09-18 | drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lack… |
CVE-2022-29240 | High | 8.1 | 2022-09-15 | Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scyl… |
CVE-2022-2308 | Medium | 6.5 | 2022-09-01 | A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with… |
CVE-2022-32745 | High | 8.1 | 2022-08-25 | A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segm… |
CVE-2021-0887 | Medium | 5.5 | 2022-08-24 | In PVRSRVBridgeHeapCfgHeapConfigName, there is a possible leak of kernel heap content due to uninitialized data. This could lead to local information disclosur… |
CVE-2021-0698 | Medium | 5.5 | 2022-08-24 | In PVRSRVBridgeHeapCfgHeapDetails, there is a possible leak of kernel heap content due to uninitialized data. This could lead to local information disclosure w… |
CVE-2022-38668 | High | 7.5 | 2022-08-22 | HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a s… |
CVE-2020-27795 | High | 7.5 | 2022-08-19 | A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when command "adf" has no or wrong argument, anal_fcn_data (core, inp… |
CVE-2022-20357 | Medium | 5.5 | 2022-08-10 | In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure w… |
CVE-2022-33716 | Low | 2.3 | 2022-08-05 | An absence of variable initialization in ICCC TA prior to SMR Aug-2022 Release 1 allows local attacker to read uninitialized memory. |
CVE-2022-34655 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured o… |
CVE-2022-26437 | Critical | 9.8 | 2022-08-01 | In httpclient, there is a possible out of bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional executio… |
CVE-2022-34266 | Medium | 5.5 | 2022-07-19 | The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerabili… |
CVE-2022-35414 | High | 8.8 | 2022-07-11 | softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third… |
CVE-2021-3435 | Medium | 4.0 | 2022-06-28 | Information leakage in le_ecred_conn_req(). Zephyr versions >= v2.4.0 Use of Uninitialized Resource (CWE-908). For more information, see https://github.com/zep… |
CVE-2021-40608 | Medium | 5.5 | 2022-06-28 | The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. |
CVE-2022-25345 | High | 7.5 | 2022-06-17 | All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initializ… |
CVE-2022-20176 | Medium | 4.4 | 2022-06-15 | In auth_store of sjtag-driver.c, there is a possible read of uninitialized memory due to a missing bounds check. This could lead to local information disclosur… |
CVE-2022-31026 | Medium | 5.9 | 2022-06-09 | Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to re… |
CVE-2022-29205 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, there is a potential for segfault / denial of ser… |
CVE-2022-20119 | Medium | 5.5 | 2022-05-10 | In private_handle_t of mali_gralloc_buffer.h, there is a possible information disclosure due to uninitialized data. This could lead to local information disclo… |
CVE-2022-20008 | Medium | 4.6 | 2022-05-10 | In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosur… |
CVE-2022-26370 | Medium | 5.9 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6, when a Session Initiation Protocol (SIP… |
CVE-2022-28488 | High | 7.5 | 2022-05-04 | The function wav_format_write in libwav.c in libwav through 2017-04-20 has an Use of Uninitialized Variable vulnerability. |
CVE-2022-20096 | Medium | 4.4 | 2022-05-03 | In camera, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileg… |
CVE-2021-41041 | Medium | 5.3 | 2022-04-27 | In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a Meth… |
CVE-2022-20079 | Medium | 4.4 | 2022-04-11 | In vow, there is a possible read of uninitialized data due to a improper input validation. This could lead to local information disclosure with System executio… |
CVE-2022-0494 | Medium | 4.4 | 2022-03-25 | A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker wi… |
CVE-2022-0433 | Medium | 5.5 | 2022-03-10 | A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter… |
CVE-2021-21966 | Medium | 5.3 | 2022-02-16 | An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A speci… |
CVE-2022-0115 | High | 8.8 | 2022-02-12 | Uninitialized use in File API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially perform out of bounds memory access via a crafted… |
CVE-2021-39671 | Medium | 6.5 | 2022-02-11 | In code generated by aidl_const_expressions.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to information disclosure wi… |
CVE-2022-23573 | High | 7.6 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `AssignOp` can result in copying uninitialized data to a new tensor. This later… |
CVE-2022-24448 | Low | 3.3 | 2022-02-04 | An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_a… |
CVE-2021-43848 | High | 7.4 | 2022-02-01 | h2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory. When receiving QUIC frames in certain… |
CVE-2021-39680 | Medium | 4.4 | 2022-01-14 | In sec_SHA256_Transform of sha256_core.c, there is a possible way to read heap data due to uninitialized data. This could lead to local information disclosure… |
CVE-2022-20018 | Medium | 4.4 | 2022-01-04 | In seninf driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution p… |
CVE-2022-20015 | Medium | 4.4 | 2022-01-04 | In kd_camera_hw driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execu… |
CVE-2021-45703 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations. |
CVE-2021-45694 | High | 7.5 | 2021-12-27 | An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations. |
CVE-2021-45693 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string_primitive may read from uninitialized memory locations. |
CVE-2021-45692 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations. |
CVE-2021-45691 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations. |
CVE-2021-45690 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations. |
CVE-2021-45689 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations. |
CVE-2021-45688 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations. |
CVE-2021-45686 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations. |
CVE-2021-45685 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations. |
CVE-2021-45684 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the flumedb crate through 2021-01-07 for Rust. read_entry may read from uninitialized memory locations. |
CVE-2021-45683 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations. |
CVE-2021-45682 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations. |
CVE-2020-36514 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations. |
CVE-2020-36513 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations. |
CVE-2020-36512 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations. |
CVE-2020-36511 | High | 7.5 | 2021-12-27 | An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations. |
CVE-2018-25023 | High | 7.5 | 2021-12-27 | An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type. |
CVE-2021-40418 | Critical | 9.8 | 2021-12-22 | When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an objec… |
CVE-2021-44003 | Medium | 5.5 | 2021-12-14 | A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable… |
CVE-2021-41253 | Medium | 5.9 | 2021-11-08 | Zydis is an x86/x86-64 disassembler library. Users of Zydis versions v3.2.0 and older that use the string functions provided in `zycore` in order to append unt… |
CVE-2021-41225 | Medium | 5.5 | 2021-11-05 | TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the `tra… |
CVE-2021-3928 | High | 7.8 | 2021-11-05 | vim is vulnerable to Use of Uninitialized Variable |
CVE-2021-34855 | Medium | 6.5 | 2021-10-25 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must fir… |
CVE-2021-0938 | Medium | 5.5 | 2021-10-25 | In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data. This could lead to local information disclos… |
CVE-2021-0634 | Medium | 6.7 | 2021-10-25 | In display driver, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege with System execution priv… |
CVE-2021-36512 | High | 7.5 | 2021-10-19 | An issue was discovered in function scanallsubs in src/sbbs3/scansubs.cpp in Synchronet BBS, which may allow attackers to view sensitive information due to an… |
CVE-2021-1619 | Critical | 9.8 | 2021-09-23 | A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to… |
CVE-2021-29631 | High | 7.8 | 2021-08-30 | In FreeBSD 13.0-STABLE before n246941-20f96f215562, 12.2-STABLE before r370400, 11.4-STABLE before r370399, 13.0-RELEASE before p4, 12.2-RELEASE before p10, an… |
CVE-2021-36007 | Low | 3.3 | 2021-08-20 | Adobe Prelude version 10.0 (and earlier) are affected by an uninitialized variable vulnerability when parsing a specially crafted file. An unauthenticated atta… |
CVE-2021-21781 | Low | 3.3 | 2021-08-18 | An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to sti… |
CVE-2021-36282 | Low | 2.5 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x - 9.1.0.x contain a use of uninitialized resource vulnerability. This can potentially allow an authenticated user with… |
CVE-2021-1104 | Critical | 9.8 | 2021-08-13 | The RISC-V Instruction Set Manual contains a documented ambiguity for the Machine Trap Vector Base Address (MTVEC) register that may lead to a vulnerability du… |
CVE-2021-37682 | Medium | 4.4 | 2021-08-12 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions all TFLite operations that use quantization can be made to use unit… |