CWE-909 Archives - CVE Vulnerability

CVE-2018-9511

Sun, 26 Feb 2023 06:51:49 +0000

In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data. This could lead to local denial of service of IPsec on sockets with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-111650288

The post CVE-2018-9511 appeared first on CVE Vulnerability.

CVE-2018-21247

Sun, 26 Feb 2023 06:48:56 +0000

An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.

The post CVE-2018-21247 appeared first on CVE Vulnerability.

CVE-2018-19519

Sun, 26 Feb 2023 06:48:11 +0000

In tcpdump 4.9.2, a stack-based buffer over-read exists in the print_prefix function of print-hncp.c via crafted packet data because of missing initialization.

The post CVE-2018-19519 appeared first on CVE Vulnerability.

CVE-2018-14647

Sun, 26 Feb 2023 06:46:24 +0000

Python’s elementtree C accelerator failed to initialise Expat’s hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat’s internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

The post CVE-2018-14647 appeared first on CVE Vulnerability.

CVE-2018-10811

Sun, 26 Feb 2023 06:45:00 +0000

strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable.

The post CVE-2018-10811 appeared first on CVE Vulnerability.

CVE-2018-1000224

Sun, 26 Feb 2023 06:44:35 +0000

Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing padding initialization vulnerability in (De)Serialization functions (core/io/marshalls.cpp) that can result in DoS (packet of death), possible leak of uninitialized memory. This attack appear to be exploitable via A malformed packet is received over the network by a Godot application that uses built-in serialization (e.g. game server, or game client). Could be triggered by multiplayer opponent. This vulnerability appears to have been fixed in 2.1.5, 3.0.6, master branch after commit feaf03421dda0213382b51aff07bd5a96b29487b.

The post CVE-2018-1000224 appeared first on CVE Vulnerability.

CVE-2020-9227

Sun, 26 Feb 2023 06:43:40 +0000

Huawei Smart Phones Moana-AL00B with versions earlier than 10.1.0.166 have a missing initialization of resource vulnerability. An attacker tricks the user into installing then running a crafted application. Due to improper initialization of specific parameters, successful exploit of this vulnerability may cause device exceptions.

The post CVE-2020-9227 appeared first on CVE Vulnerability.

CVE-2020-6792

Sun, 26 Feb 2023 06:42:51 +0000

When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 68.5.

The post CVE-2020-6792 appeared first on CVE Vulnerability.

CVE-2020-25579

Sun, 26 Feb 2023 06:39:45 +0000

In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes.

The post CVE-2020-25579 appeared first on CVE Vulnerability.

CVE-2020-24455

Sun, 26 Feb 2023 06:39:27 +0000

Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before 3.0.1 and before 2.4.3.

The post CVE-2020-24455 appeared first on CVE Vulnerability.