CWE-908 Use of Uninitialized Resource
baseThe product uses or accesses a resource that has not been initialized.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (1064)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-85880US | high7.8OT critical | KEV | ||
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-5777US | high7.5OT critical | KEV | ||
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server | ||||
| CVE-2024-50302US | medium5.5OT critical | KEV | ||
In the Linux kernel, the following vulnerability has been resolved:
HID: core: zero-initialize the report buffer
Since the report buffer is used by all kinds of drivers in variou… | ||||
| CVE-2024-29745US | medium5.5OT critical | KEV | ||
there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interacti… | ||||
| CVE-2008-0081US | critical9.8 | Exploit | ||
Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via cra… | ||||
| CVE-2011-1255US | high9.3 | Exploit | ||
The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remot… | ||||
| CVE-2007-1751US | high9.3 | — | ||
Microsoft Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code by causing Internet Explorer to access an uninitialized or deleted object, related to p… | ||||
| CVE-2002-2281US | high10.0 | Exploit | ||
Symantec Java! JIT (Just-In-Time) Compiler for Netscape Communicator 4.0 through 4.8 allows remote attackers to execute arbitrary Java commands via an applet that uses a jump call,… | ||||
| CVE-2008-3475US | high8.8 | — | ||
Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) delete… | ||||
| CVE-2012-1891US | high9.3 | — | ||
Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary cod… | ||||
| CVE-2011-1995US | high9.3 | — | ||
Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not prop… | ||||
| CVE-2010-3346US | high9.3 | — | ||
Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not… | ||||
| CVE-2010-3345US | high9.3 | — | ||
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly i… | ||||
| CVE-2010-3343US | high9.3 | — | ||
Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly i… | ||||
| CVE-2010-2559US | high9.3 | — | ||
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly i… | ||||
| CVE-2010-2557US | high9.3 | — | ||
Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly i… | ||||
| CVE-2010-2556US | high9.3 | — | ||
Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not… | ||||
| CVE-2009-1529US | high9.3 | — | ||
Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not properly handle objects in memor… | ||||
| CVE-2009-0949US | high7.5 | Exploit | ||
The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of… | ||||
| CVE-2009-2692US | high7.8 | Exploit | ||
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local use… | ||||
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan