CWE-908 · Use of Uninitialized Resource (page 7)
Page 7 of 9 — CVEs classified under CWE-908, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-36452 | Critical | 9.8 | 2021-08-08 | An issue was discovered in the array-tools crate before 0.3.2 for Rust. FixedCapacityDequeLike::clone() has a drop of uninitialized memory. |
CVE-2020-36443 | Critical | 9.8 | 2021-08-08 | An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provid… |
CVE-2020-36432 | Critical | 9.8 | 2021-08-08 | An issue was discovered in the alg_ds crate through 2020-08-25 for Rust. There is a drop of uninitialized memory in Matrix::new(). |
CVE-2021-22925 | Medium | 5.3 | 2021-08-05 | curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET… |
CVE-2021-30578 | High | 8.8 | 2021-08-03 | Uninitialized use in Media in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. |
CVE-2021-0530 | High | 7.8 | 2021-06-21 | In memory management driver, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with no additi… |
CVE-2021-0526 | High | 7.8 | 2021-06-21 | In memory management driver, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with no additi… |
CVE-2021-0495 | High | 7.8 | 2021-06-11 | In memory management driver, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with no additi… |
CVE-2021-0473 | High | 8.8 | 2021-06-11 | In rw_t3t_process_error of rw_t3t.cc, there is a possible double free due to uninitialized data. This could lead to remote code execution over NFC with no addi… |
CVE-2020-11260 | High | 8.4 | 2021-06-09 | An improper free of uninitialized memory can occur in DIAG services in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile |
CVE-2021-3545 | Medium | 6.5 | 2021-06-02 | An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw ex… |
CVE-2018-25014 | Critical | 9.8 | 2021-05-21 | A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol(). |
CVE-2021-29581 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.CTCBeamSearchDecoder`, an attacker can trigger… |
CVE-2021-29580 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FractionalMaxPoolGrad` triggers an undefined behavior… |
CVE-2021-29623 | Low | 3.6 | 2021-05-13 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was… |
CVE-2021-31423 | Medium | 6.0 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first… |
CVE-2021-31419 | Medium | 6.5 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first… |
CVE-2021-31418 | Medium | 6.5 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first… |
CVE-2021-31417 | Medium | 6.5 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first… |
CVE-2021-30027 | Medium | 5.5 | 2021-04-29 | md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malformed Markdown documen… |
CVE-2021-21218 | Medium | 5.5 | 2021-04-26 | Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-29937 | Critical | 9.8 | 2021-04-01 | An issue was discovered in the telemetry crate through 2021-02-17 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc… |
CVE-2021-29936 | Critical | 9.8 | 2021-04-01 | An issue was discovered in the adtensor crate through 2021-01-11 for Rust. There is a drop of uninitialized memory via the FromIterator implementation for Vect… |
CVE-2021-29934 | High | 7.3 | 2021-04-01 | An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user… |
CVE-2021-0463 | Medium | 5.5 | 2021-03-10 | In convertToHidl of convert.cpp, there is a possible out of bounds read due to uninitialized data from ReturnFrameworkMessage. This could lead to local informa… |
CVE-2021-21190 | High | 8.8 | 2021-03-09 | Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2021-28035 | Critical | 9.8 | 2021-03-05 | An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a drop of uninitialized memory can occur upon a val.c… |
CVE-2021-28033 | Critical | 9.8 | 2021-03-05 | An issue was discovered in the byte_struct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics. |
CVE-2021-28030 | High | 7.5 | 2021-03-05 | An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Rea… |
CVE-2021-28029 | High | 7.5 | 2021-03-05 | An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory loca… |
CVE-2021-26953 | High | 7.5 | 2021-02-09 | An issue was discovered in the postscript crate before 0.14.0 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory loca… |
CVE-2021-26952 | High | 7.5 | 2021-02-09 | An issue was discovered in the ms3d crate before 0.1.3 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations v… |
CVE-2021-26951 | Critical | 9.8 | 2021-02-09 | An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used witho… |
CVE-2021-26305 | Critical | 9.8 | 2021-01-29 | An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old conten… |
CVE-2021-25905 | Critical | 9.1 | 2021-01-26 | An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory. |
CVE-2020-36210 | High | 7.8 | 2021-01-26 | An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs… |
CVE-2020-16042 | Medium | 6.5 | 2021-01-08 | Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a… |
CVE-2020-35494 | Medium | 6.1 | 2021-01-04 | There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninit… |
CVE-2020-35893 | High | 7.5 | 2020-12-31 | An issue was discovered in the simple-slab crate before 0.3.3 for Rust. remove() has an off-by-one error, causing memory leakage and a drop of uninitialized me… |
CVE-2020-35888 | Critical | 9.8 | 2020-12-31 | An issue was discovered in the arr crate through 2020-08-25 for Rust. Uninitialized memory is dropped by Array::new_from_template. |
CVE-2020-35878 | Critical | 9.8 | 2020-12-31 | An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of the dropping of uninitialized memory. |
CVE-2020-26266 | Medium | 4.4 | 2020-12-10 | In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having te… |
CVE-2020-26271 | Medium | 4.4 | 2020-12-10 | In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph… |
CVE-2020-29371 | Low | 3.3 | 2020-11-28 | An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd. |
CVE-2020-16985 | Medium | 6.2 | 2020-11-11 | Azure Sphere Information Disclosure Vulnerability |
CVE-2020-15989 | Medium | 5.5 | 2020-11-03 | Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2020-16932 | High | 7.8 | 2020-10-16 | <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who succe… |
CVE-2020-16931 | High | 7.8 | 2020-10-16 | <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who succe… |
CVE-2020-0411 | Medium | 6.5 | 2020-10-14 | In ~AACExtractor() of AACExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This could lead to remote information disclosure wit… |
CVE-2020-17482 | Medium | 4.3 | 2020-10-02 | An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be… |
CVE-2020-26148 | High | 7.5 | 2020-09-30 | md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial of service (e.g., assertion failure) vi… |
CVE-2020-15193 | High | 7.1 | 2020-09-25 | In Tensorflow before versions 2.2.1 and 2.3.1, the implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory cor… |
CVE-2020-0326 | Medium | 6.7 | 2020-09-18 | In NFC, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2020-0300 | High | 7.5 | 2020-09-18 | In NFC, there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure with no additional execution privile… |
CVE-2020-0272 | Medium | 4.4 | 2020-09-18 | In libhwbinder, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution pri… |
CVE-2020-0361 | Medium | 6.5 | 2020-09-17 | In libDRCdec, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional executi… |
CVE-2020-0340 | Medium | 6.5 | 2020-09-17 | In libcodec2_soft_mp3dec, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additi… |
CVE-2020-0321 | High | 8.8 | 2020-09-17 | In the mp3 extractor, there is a possible out of bounds write due to uninitialized data. This could lead to remote code execution with no additional execution… |
CVE-2020-24753 | Critical | 9.8 | 2020-09-17 | A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via crafted… |
CVE-2020-16855 | Medium | 5.5 | 2020-09-11 | <p>An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclo… |
CVE-2019-14052 | Critical | 9.8 | 2020-09-08 | u'Accessing an uninitialized data structure could result in partially copying of contents and thus incorrect processing' in Snapdragon Auto, Snapdragon Compute… |
CVE-2020-14704 | Medium | 6.0 | 2020-07-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior t… |
CVE-2020-14703 | Medium | 6.0 | 2020-07-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior t… |
CVE-2020-1342 | Medium | 5.5 | 2020-07-14 | An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose… |
CVE-2020-15523 | High | 7.8 | 2020-07-04 | In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases wh… |
CVE-2020-3964 | Medium | 4.7 | 2020-06-25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and F… |
CVE-2020-10732 | Low | 3.3 | 2020-06-12 | A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and… |
CVE-2020-0195 | Medium | 6.5 | 2020-06-11 | In ihevcd_iquant_itrans_recon_ctb of ihevcd_iquant_itrans_recon_ctb.c and related functions, there is a possible information disclosure due to uninitialized da… |
CVE-2020-13899 | High | 7.5 | 2020-06-10 | An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_process_incoming_request in janus.c discloses information from uniniti… |
CVE-2020-1322 | Medium | 6.5 | 2020-06-09 | An information disclosure vulnerability exists when Microsoft Project reads out of bound memory due to an uninitialized variable, aka 'Microsoft Project Inform… |
CVE-2020-1206 | High | 7.5 | 2020-06-09 | An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows… |
CVE-2020-13113 | High | 8.2 | 2020-05-21 | An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free con… |
CVE-2020-0101 | Medium | 5.5 | 2020-05-14 | In BnCrypto::onTransact of ICrypto.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure w… |
CVE-2020-10933 | Medium | 5.3 | 2020-05-04 | An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, except… |
CVE-2020-2575 | High | 7.5 | 2020-04-29 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior t… |
CVE-2020-7451 | Medium | 5.3 | 2020-04-28 | In FreeBSD 12.1-STABLE before r358739, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r358740, and 11.3-RELEASE before 11.3-RELEASE-p7, a TCP SYN-ACK… |
CVE-2020-6821 | High | 7.5 | 2020-04-24 | When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returne… |
CVE-2020-11828 | High | 7.5 | 2020-04-21 | In ColorOS (oppo mobile phone operating system, based on AOSP frameworks/native code position/services/surfaceflinger surfaceflinger.CPP), RGB is defined on th… |
CVE-2019-20785 | Medium | 6.8 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carrier. RILD in the radio layer uses an uninitialized variable… |
CVE-2020-6444 | Medium | 6.3 | 2020-04-13 | Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-11494 | Medium | 4.4 | 2020-04-02 | An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data… |
CVE-2020-1934 | Medium | 5.3 | 2020-04-01 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. |
CVE-2020-11104 | Medium | 5.3 | 2020-03-30 | An issue was discovered in USC iLab cereal through 1.3.0. Serialization of an (initialized) C/C++ long double variable into a BinaryArchive or PortableBinaryAr… |
CVE-2019-20623 | Low | 3.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) software. Gallery has uninitialized memory disclosure. The Samsung ID is SVE-… |
CVE-2020-0049 | Medium | 6.5 | 2020-03-10 | In onReadBuffer() of StreamingSource.cpp, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosur… |
CVE-2020-0048 | Medium | 5.5 | 2020-03-10 | In onTransact of IAudioFlinger.cpp, there is a possible stack information leak due to uninitialized data. This could lead to local information disclosure with… |
CVE-2019-14079 | High | 7.8 | 2020-03-05 | Access to the uninitialized variable when the driver tries to unmap the dma buffer of a request which was never mapped in the first place leading to kernel fai… |
CVE-2020-6793 | Medium | 6.5 | 2020-03-02 | When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. This vulnerability affects Thunderbird… |
CVE-2020-6792 | Medium | 4.3 | 2020-03-02 | When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 6… |
CVE-2020-7042 | Medium | 5.3 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check ope… |
CVE-2020-6398 | High | 8.8 | 2020-02-11 | Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF f… |
CVE-2019-14044 | High | 7.8 | 2020-02-07 | Out of bound access due to access of uninitialized memory segment in an array of pointers while normal camera open close in Snapdragon Consumer IOT, Snapdragon… |
CVE-2020-0007 | Medium | 5.5 | 2020-01-08 | In flattenString8 of Sensor.cpp, there is a possible information disclosure of heap memory due to uninitialized data. This could lead to local information disc… |
CVE-2020-0006 | Medium | 6.5 | 2020-01-08 | In rw_i93_send_cmd_write_single_block of rw_i93.cc, there is a possible information disclosure of heap memory due to uninitialized data. This could lead to rem… |
CVE-2019-19947 | Medium | 4.6 | 2019-12-24 | In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c… |
CVE-2019-1462 | High | 7.8 | 2019-12-10 | A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft Powe… |
CVE-2019-13751 | Medium | 6.5 | 2019-12-10 | Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-13747 | High | 8.8 | 2019-12-10 | Uninitialized data in rendering in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2019-19535 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driv… |
CVE-2019-19240 | Medium | 5.3 | 2019-11-22 | Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limi… |