CWE-475 Undefined Behavior for Input to API
baseThe behavior of this function is undefined unless its control parameter is set to a specific value.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (19)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-47865US | critical9.8 | — | ||
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations. | ||||
| CVE-2026-75595US | critical9.1 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong off… | ||||
| CVE-2020-7925US | high7.5 | — | ||
Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause… | ||||
| CVE-2025-47866US | high7.5 | — | ||
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations. | ||||
| CVE-2023-4874US | medium6.5 | — | ||
Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 | ||||
| CVE-2023-2253US | medium6.5 | — | ||
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This… | ||||
| CVE-2023-4875US | medium5.7 | — | ||
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 | ||||
| CVE-2024-3099US | medium5.4 | — | ||
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (D… | ||||
| CVE-2022-29207US | medium5.5 | — | ||
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resour… | ||||
| CVE-2026-73797US | — | — | ||
A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called. | ||||
| CVE-2026-19311US | — | — | ||
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a… | ||||
| CVE-2026-42009US | — | — | ||
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible f… | ||||
| CVE-2026-8391US | — | — | ||
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. | ||||
| CVE-2026-34379US | — | — | ||
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9,… | ||||
| CVE-2026-21690US | — | — | ||
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versio… | ||||
| CVE-2024-7046US | —OT elevated | — | ||
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2024-10569US | — | — | ||
A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which ca… | ||||
| CVE-2024-20380US | — | — | ||
A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
The vulnerability… | ||||
| CVE-2023-52533US | — | — | ||
In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional execution privileges ne… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan