CWE-909 Missing Initialization of Resource
classThe product does not initialize a critical resource.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (139)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-0847US | high7.8OT critical | KEV | ||
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux ker… | ||||
| CVE-2015-5621US | high7.5 | Exploit | ||
The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, whi… | ||||
| CVE-2022-29968US | high7.8 | Exploit | ||
An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private. | ||||
| CVE-2018-1000224US | high7.5 | Exploit | ||
Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing paddi… | ||||
| CVE-2022-22704US | critical9.8 | — | ||
The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd would (in effect) dete… | ||||
| CVE-2020-36452US | critical9.8 | — | ||
An issue was discovered in the array-tools crate before 0.3.2 for Rust. FixedCapacityDequeLike::clone() has a drop of uninitialized memory. | ||||
| CVE-2020-12352US | medium6.5 | Exploit | ||
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access. | ||||
| CVE-2026-40687US | critical9.1 | — | ||
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or err… | ||||
| CVE-2021-23994US | high8.8 | — | ||
A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10,… | ||||
| CVE-2019-25016US | high8.8 | — | ||
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules… | ||||
| CVE-2020-12523US | critical9.1 | — | ||
On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integra… | ||||
| CVE-2024-8178US | high8.8 | — | ||
The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it.
Malicious software running in a guest VM that exposes vir… | ||||
| CVE-2021-29980US | high8.8 | — | ||
Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbi… | ||||
| CVE-2020-11741US | high8.8 | — | ||
An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests, cause a denial of ser… | ||||
| CVE-2018-14647US | high7.5 | — | ||
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by const… | ||||
| CVE-2019-9639US | high7.5 | — | ||
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE bec… | ||||
| CVE-2019-12410US | high7.5 | — | ||
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when re… | ||||
| CVE-2019-3804US | high7.5 | — | ||
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a s… | ||||
| CVE-2018-10811US | high7.5 | — | ||
strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable. | ||||
| CVE-2026-45896US | high7.8 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
mtd: intel-dg: Fix accessing regions before setting nregions
The regions array is counted by nregions, but it'… | ||||
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan