CWE-242 Use of Inherently Dangerous Function
baseThe product calls a function that can never be guaranteed to work safely.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (13)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-1002157US | critical9.8 | — | ||
modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution. | ||||
| CVE-2024-52324US | critical9.8 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in d… | ||||
| CVE-2022-36310US | high8.8 | — | ||
Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute com… | ||||
| CVE-2017-0904US | high8.1 | — | ||
The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for s… | ||||
| CVE-2021-42543US | high7.8 | — | ||
The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown. | ||||
| CVE-2021-40698US | high7.4 | — | ||
ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security… | ||||
| CVE-2023-39495US | medium5.5 | — | ||
PDF-XChange Editor readFileIntoStream Exposed Dangerous Function Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information… | ||||
| CVE-2026-98386US | — | — | ||
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
For QLAFX00 the request ring is ioremapped d… | ||||
| CVE-2026-11980US | — | — | ||
IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up. | ||||
| CVE-2026-6477US | — | — | ||
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser… | ||||
| CVE-2025-1994US | — | — | ||
IBM Cognos Command Center 10.2.4.1 and 10.2.5
could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the BinaryFormatter function. | ||||
| CVE-2025-49215US | — | — | ||
A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations.
Please not… | ||||
| CVE-2025-1331US | — | — | ||
IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the gets function. | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan