CWE-665
DiscouragedImproper Initialization
Abstraction: Class · Status: Draft
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
432 vulnerabilities reference this CWE, most recent first.
GHSA-R5W6-VHVV-2Q6G
Vulnerability from github – Published: 2024-07-10 03:30 – Updated: 2024-07-10 03:30Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some UEFI code, leading to arbitrary code execution or escalation of privilege.
{
"affected": [],
"aliases": [
"CVE-2023-32467"
],
"database_specific": {
"cwe_ids": [
"CWE-665"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-10T03:15:01Z",
"severity": "MODERATE"
},
"details": "Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some UEFI code, leading to arbitrary code execution or escalation of privilege.",
"id": "GHSA-r5w6-vhvv-2q6g",
"modified": "2024-07-10T03:30:35Z",
"published": "2024-07-10T03:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32467"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-in/000214917/dsa-2023-225-security-update-for-dell-bios-edge-gateway-5200-and-edge-gateway-3200"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-R64Q-RCP8-3M38
Vulnerability from github – Published: 2023-10-29 09:30 – Updated: 2023-11-08 15:30When malicious images are pulled by isula pull, attackers can execute arbitrary code.
{
"affected": [],
"aliases": [
"CVE-2021-33635"
],
"database_specific": {
"cwe_ids": [
"CWE-665",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-29T08:15:20Z",
"severity": "HIGH"
},
"details": "When malicious images are pulled by isula pull, attackers can execute arbitrary code.",
"id": "GHSA-r64q-rcp8-3m38",
"modified": "2023-11-08T15:30:32Z",
"published": "2023-10-29T09:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33635"
},
{
"type": "WEB",
"url": "https://gitee.com/src-openeuler/iSulad/pulls/600/files"
},
{
"type": "WEB",
"url": "https://gitee.com/src-openeuler/iSulad/pulls/627/files"
},
{
"type": "WEB",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2023-1686"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R8FQ-XFH5-MVGX
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2026-08-19 15:31OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 83.
{
"affected": [],
"aliases": [
"CVE-2020-26957"
],
"database_specific": {
"cwe_ids": [
"CWE-665"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-09T01:15:00Z",
"severity": "MODERATE"
},
"details": "OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox \u003c 83.",
"id": "GHSA-r8fq-xfh5-mvgx",
"modified": "2026-08-19T15:31:51Z",
"published": "2022-05-24T17:35:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26957"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1667179"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2020-50"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R8MP-G255-9XM8
Vulnerability from github – Published: 2022-06-03 00:01 – Updated: 2022-06-11 00:00Unicorn Engine v2.0.0-rc7 contains memory leaks caused by an incomplete unicorn engine initialization.
{
"affected": [],
"aliases": [
"CVE-2022-29695"
],
"database_specific": {
"cwe_ids": [
"CWE-665"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-02T14:15:00Z",
"severity": "HIGH"
},
"details": "Unicorn Engine v2.0.0-rc7 contains memory leaks caused by an incomplete unicorn engine initialization.",
"id": "GHSA-r8mp-g255-9xm8",
"modified": "2022-06-11T00:00:18Z",
"published": "2022-06-03T00:01:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29695"
},
{
"type": "WEB",
"url": "https://github.com/unicorn-engine/unicorn/issues/1595"
},
{
"type": "WEB",
"url": "https://github.com/unicorn-engine/unicorn/commit/5a79d7879ca3ee0ce684ad6576d8ac15e8d90fc7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RC33-44QP-VPVQ
Vulnerability from github – Published: 2023-08-16 15:30 – Updated: 2023-08-16 21:04Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.
This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.
Additionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.
As of publication of this advisory, there is no fix.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:gogs-webhook"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-40349"
],
"database_specific": {
"cwe_ids": [
"CWE-665"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-16T21:04:57Z",
"nvd_published_at": "2023-08-16T15:15:12Z",
"severity": "MODERATE"
},
"details": "Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.\n\nThis allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.\n\nAdditionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.\n\nAs of publication of this advisory, there is no fix.",
"id": "GHSA-rc33-44qp-vpvq",
"modified": "2023-08-16T21:04:57Z",
"published": "2023-08-16T15:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40349"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2894"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/08/16/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure"
}
GHSA-RCCG-5MCC-M2CF
Vulnerability from github – Published: 2022-05-24 17:18 – Updated: 2022-09-03 00:00A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function virtio_dev_rx_batch_packed().
{
"affected": [],
"aliases": [
"CVE-2020-10725"
],
"database_specific": {
"cwe_ids": [
"CWE-665"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-20T14:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`.",
"id": "GHSA-rccg-5mcc-m2cf",
"modified": "2022-09-03T00:00:20Z",
"published": "2022-05-24T17:18:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10725"
},
{
"type": "WEB",
"url": "https://bugs.dpdk.org/show_bug.cgi?id=270"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10725"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2020/05/18/2"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RCWF-5V85-2GGR
Vulnerability from github – Published: 2026-08-25 21:31 – Updated: 2026-08-27 21:31Improper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-78940"
],
"database_specific": {
"cwe_ids": [
"CWE-665"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T21:17:49Z",
"severity": "MODERATE"
},
"details": "Improper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-rcwf-5v85-2ggr",
"modified": "2026-08-27T21:31:22Z",
"published": "2026-08-25T21:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78940"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/511819962"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RF3G-V8P5-P675
Vulnerability from github – Published: 2022-12-05 23:06 – Updated: 2022-12-05 23:06Impact
Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts.
Patches
Patched in 2.6.1
Workarounds
Site maintainers can cherry-pick https://github.com/NodeBB/NodeBB/commit/48d143921753914da45926cca6370a92ed0c46b8 into their codebase to patch the exploit.
For more information
If you have any questions or comments about this advisory:
Discuss it on our community forum Email us at support@nodebb.org
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nodebb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-46164"
],
"database_specific": {
"cwe_ids": [
"CWE-665"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-05T23:06:14Z",
"nvd_published_at": "2022-12-05T21:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\nDue to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts.\n\n### Patches\nPatched in 2.6.1\n\n### Workarounds\nSite maintainers can cherry-pick https://github.com/NodeBB/NodeBB/commit/48d143921753914da45926cca6370a92ed0c46b8 into their codebase to patch the exploit.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nDiscuss it on [our community forum](https://github.com/NodeBB/NodeBB/security/advisories/community.nodebb.org/)\nEmail us at [support@nodebb.org](mailto:support@nodebb.org)\n",
"id": "GHSA-rf3g-v8p5-p675",
"modified": "2022-12-05T23:06:14Z",
"published": "2022-12-05T23:06:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-rf3g-v8p5-p675"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46164"
},
{
"type": "WEB",
"url": "https://github.com/NodeBB/NodeBB/commit/48d143921753914da45926cca6370a92ed0c46b8"
},
{
"type": "PACKAGE",
"url": "https://github.com/NodeBB/NodeBB"
},
{
"type": "WEB",
"url": "https://github.com/NodeBB/NodeBB/releases/tag/v2.6.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "NodeBB vulnerable to account takeover via prototype vulnerability"
}
GHSA-RF3H-5HXX-PG9M
Vulnerability from github – Published: 2022-05-13 01:30 – Updated: 2022-05-13 01:30The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4419, CVE-2014-4420, and CVE-2014-4421.
{
"affected": [],
"aliases": [
"CVE-2014-4371"
],
"database_specific": {
"cwe_ids": [
"CWE-665"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-09-18T10:55:00Z",
"severity": "LOW"
},
"details": "The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4419, CVE-2014-4420, and CVE-2014-4421.",
"id": "GHSA-rf3h-5hxx-pg9m",
"modified": "2022-05-13T01:30:39Z",
"published": "2022-05-13T01:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4371"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96100"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT6535"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html"
},
{
"type": "WEB",
"url": "http://support.apple.com/HT204244"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT6441"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT6442"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/69882"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/69919"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1030866"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RFC2-M7M4-3XVG
Vulnerability from github – Published: 2023-08-11 03:30 – Updated: 2024-04-04 06:50Improper initialization in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access.
{
"affected": [],
"aliases": [
"CVE-2023-22356"
],
"database_specific": {
"cwe_ids": [
"CWE-665"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-11T03:15:16Z",
"severity": "MODERATE"
},
"details": "Improper initialization in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access.",
"id": "GHSA-rfc2-m7m4-3xvg",
"modified": "2024-04-04T06:50:42Z",
"published": "2023-08-11T03:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22356"
},
{
"type": "WEB",
"url": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-3
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
Mitigation
Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
Mitigation
Avoid race conditions (CWE-362) during initialization routines.
Mitigation
Run or compile your product with settings that generate warnings about uninitialized variables or data.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.