CWE-665 · 333 records
Improper Initialization
CVEs in this class
334 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
89Now | CVE-2022-0847Weaponized | A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe linux · linux kernel · CWE-665 | High7.8 | KEV | 92.7% | Mar 10, 2022 |
60This week | CVE-2013-1675Weaponized | Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not propermozilla · firefox · CWE-665 | Medium6.5 | KEV | 6.6% | May 16, 2013 |
57Plan | CVE-2020-27950Weaponized | A memory initialization issue was addressed.apple · ipados · CWE-665 | Medium5.5 | KEV | 16.5% | Dec 8, 2020 |
53Plan | CVE-2022-46164Proof of concept | Account takeover via prototype vulnerabilitynodebb · nodebb · CWE-665 | Critical9.8 | — | 47.3% | Dec 5, 2022 |
51Plan | CVE-2022-22719No exploit | mod_lua Use of uninitialized value of in r:parsebodyapache · http server · CWE-665 | High7.5 | — | 69.0% | Mar 14, 2022 |
48Plan | CVE-2020-28019No exploit | Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences.exim · exim · CWE-665 | High7.5 | — | 61.6% | May 6, 2021 |
46Plan | CVE-2022-37128No exploit | In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.dlink · dir-816 firmware · CWE-665 | Critical9.8 | — | 21.7% | Aug 31, 2022 |
45Plan | CVE-2019-14271Proof of concept | In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamicaldocker · docker · CWE-665 | Critical9.8 | — | 18.8% | Jul 29, 2019 |
42Plan | CVE-2008-0062No exploit | KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial mit · kerberos 5 · CWE-665 | Critical9.8 | — | 10.1% | Mar 19, 2008 |
42Plan | CVE-2017-13715No exploit | The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoflinux · linux kernel · CWE-665 | Critical9.8 | — | 9.6% | Aug 28, 2017 |
41Plan | CVE-2015-8367No exploit | The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related libraw · libraw · CWE-665 | Critical9.8 | — | 5.6% | Jan 14, 2020 |
40Plan | CVE-2023-1719Proof of concept | Bitrix24 Insecure Global Variable Extractionbitrix24 · bitrix24 · CWE-665 | Critical9.8 | — | 4.9% | Nov 1, 2023 |
40Plan | CVE-2019-3464No exploit | Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that shoupizzashack · rssh · CWE-665 | Critical9.8 | — | 4.6% | Feb 6, 2019 |
40Plan | CVE-2022-21724No exploit | Unchecked Class Instantiation when providing Plugin Classespostgresql · postgresql jdbc driver · CWE-665 | Critical9.8 | — | 3.0% | Feb 2, 2022 |
40Plan | CVE-2023-20591No exploit | Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker toamd · epyc 8024pn firmware · CWE-665 | Critical10.0 | — | 0.2% | Aug 13, 2024 |
39Monitor | CVE-2021-41264No exploit | UUPSUpgradeable vulnerability in OpenZeppelin Contractsopenzeppelin · contracts · CWE-665 | Critical9.8 | — | 1.4% | Nov 12, 2021 |
39Monitor | CVE-2019-10196No exploit | A flaw was found in http-proxy-agent, prior to version 2.1.0.http-proxy-agent project · http-proxy-agent · CWE-665 | Critical9.8 | — | 1.3% | Mar 19, 2021 |
39Monitor | CVE-2022-36061No exploit | Elrond go can execute on same context checks in VMelrond · elrond go · CWE-665 | Critical9.8 | — | 1.2% | Sep 6, 2022 |
39Monitor | CVE-2018-11949No exploit | Failure to initialize the extra buffer can lead to an out of buffer access in WLAN function in Snapdragon Auto, Snapdragon Compute, Snapdragqualcomm · mdm9150 firmware · CWE-665 | Critical9.8 | — | 0.9% | May 24, 2019 |
39Monitor | CVE-2022-0947No exploit | Arctic Wireless Gateway Firewall vulnerabilityabb · arg600a1220na firmware · CWE-665 | Critical9.8 | — | 0.8% | May 10, 2022 |
39Monitor | CVE-2026-64775No exploit | A memory initialization issue was addressed with improved memory handling.apple · ipados · CWE-665 | Critical9.8 | — | 0.6% | Jul 27, 2026 |
39Monitor | CVE-2026-53398No exploit | NFSD: Fix SECINFO_NO_NAME decode error cleanuplinux · linux kernel · CWE-665 | Critical9.8 | — | 0.5% | Jul 19, 2026 |
37Monitor | CVE-2001-1471Proof of concept | prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prphpbb · phpbb · CWE-665 | High8.8 | — | 7.7% | Jul 31, 2001 |
37Monitor | CVE-2008-3637No exploit | The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11, 10.5.4, and 10.5.5 uses an uninitialized variaapple · mac os x · CWE-665 | High8.8 | — | 5.7% | Sep 26, 2008 |
37Monitor | CVE-2017-5468No exploit | An issue with incorrect ownership model of "privateBrowsing" information exposed through developer tools.mozilla · firefox · CWE-665 | Critical9.1 | — | 2.3% | Jun 11, 2018 |
- CVE-2022-084789Now
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe
HighCVSS 7.8KEVWeaponizedEPSS 92%linux · linux kernelMar 10, 2022
- CVE-2013-167560This week
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not proper
MediumCVSS 6.5KEVWeaponizedEPSS 6%mozilla · firefoxMay 16, 2013
- CVE-2020-2795057Plan
A memory initialization issue was addressed.
MediumCVSS 5.5KEVWeaponizedEPSS 16%apple · ipadosDec 8, 2020
- CVE-2022-4616453Plan
Account takeover via prototype vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 47%nodebb · nodebbDec 5, 2022
- CVE-2022-2271951Plan
mod_lua Use of uninitialized value of in r:parsebody
HighCVSS 7.5No exploitEPSS 69%apache · http serverMar 14, 2022
- CVE-2020-2801948Plan
Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences.
HighCVSS 7.5No exploitEPSS 61%exim · eximMay 6, 2021
- CVE-2022-3712846Plan
In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.
CriticalCVSS 9.8No exploitEPSS 21%dlink · dir-816 firmwareAug 31, 2022
- CVE-2019-1427145Plan
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamical
CriticalCVSS 9.8Proof of conceptEPSS 18%docker · dockerJul 29, 2019
- CVE-2008-006242Plan
KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial
CriticalCVSS 9.8No exploitEPSS 10%mit · kerberos 5Mar 19, 2008
- CVE-2017-1371542Plan
The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thof
CriticalCVSS 9.8No exploitEPSS 9%linux · linux kernelAug 28, 2017
- CVE-2015-836741Plan
The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related
CriticalCVSS 9.8No exploitEPSS 5%libraw · librawJan 14, 2020
- CVE-2023-171940Plan
Bitrix24 Insecure Global Variable Extraction
CriticalCVSS 9.8Proof of conceptEPSS 4%bitrix24 · bitrix24Nov 1, 2023
- CVE-2019-346440Plan
Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that shou
CriticalCVSS 9.8No exploitEPSS 4%pizzashack · rsshFeb 6, 2019
- CVE-2022-2172440Plan
Unchecked Class Instantiation when providing Plugin Classes
CriticalCVSS 9.8No exploitEPSS 3%postgresql · postgresql jdbc driverFeb 2, 2022
- CVE-2023-2059140Plan
Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker to
CriticalCVSS 10.0No exploitEPSS 0%amd · epyc 8024pn firmwareAug 13, 2024
- CVE-2021-4126439Monitor
UUPSUpgradeable vulnerability in OpenZeppelin Contracts
CriticalCVSS 9.8No exploitEPSS 1%openzeppelin · contractsNov 12, 2021
- CVE-2019-1019639Monitor
A flaw was found in http-proxy-agent, prior to version 2.1.0.
CriticalCVSS 9.8No exploitEPSS 1%http-proxy-agent project · http-proxy-agentMar 19, 2021
- CVE-2022-3606139Monitor
Elrond go can execute on same context checks in VM
CriticalCVSS 9.8No exploitEPSS 1%elrond · elrond goSep 6, 2022
- CVE-2018-1194939Monitor
Failure to initialize the extra buffer can lead to an out of buffer access in WLAN function in Snapdragon Auto, Snapdragon Compute, Snapdrag
CriticalCVSS 9.8No exploitEPSS 0%qualcomm · mdm9150 firmwareMay 24, 2019
- CVE-2022-094739Monitor
Arctic Wireless Gateway Firewall vulnerability
CriticalCVSS 9.8No exploitEPSS 0%abb · arg600a1220na firmwareMay 10, 2022
- CVE-2026-6477539Monitor
A memory initialization issue was addressed with improved memory handling.
CriticalCVSS 9.8No exploitEPSS 0%apple · ipadosJul 27, 2026
- CVE-2026-5339839Monitor
NFSD: Fix SECINFO_NO_NAME decode error cleanup
CriticalCVSS 9.8No exploitEPSS 0%linux · linux kernelJul 19, 2026
- CVE-2001-147137Monitor
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which pr
HighCVSS 8.8Proof of conceptEPSS 7%phpbb · phpbbJul 31, 2001
- CVE-2008-363737Monitor
The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11, 10.5.4, and 10.5.5 uses an uninitialized varia
HighCVSS 8.8No exploitEPSS 5%apple · mac os xSep 26, 2008
- CVE-2017-546837Monitor
An issue with incorrect ownership model of "privateBrowsing" information exposed through developer tools.
CriticalCVSS 9.1No exploitEPSS 2%mozilla · firefoxJun 11, 2018