CWE-242
Use of Inherently Dangerous Function
Description
The product calls a function that can never be guaranteed to work safely.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (11)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-52324 | Cri | 0.64 | 9.8 | 0.01 | Dec 6, 2024 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands. | ||
| CVE-2017-1002157 | Cri | 0.64 | 9.8 | 0.03 | Jan 10, 2019 | modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution. | ||
| CVE-2026-6477 | Hig | 0.57 | 8.8 | 0.00 | May 14, 2026 | Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(...,… | ||
| CVE-2025-49215 | Hig | 0.57 | 8.8 | 0.00 | Jun 17, 2025 | A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to… | ||
| CVE-2022-36310 | Hig | 0.57 | 8.8 | 0.01 | Aug 16, 2022 | Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpeed models. | ||
| CVE-2025-1994 | Hig | 0.51 | 7.8 | 0.00 | Aug 26, 2025 | IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the BinaryFormatter function. | ||
| CVE-2025-1331 | Hig | 0.51 | 7.8 | 0.00 | May 8, 2025 | IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the gets function. | ||
| CVE-2021-42543 | Hig | 0.51 | 7.8 | 0.01 | Nov 5, 2021 | The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown. | ||
| CVE-2021-40698 | Hig | 0.48 | 7.4 | 0.01 | Sep 7, 2023 | ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass . An authenticated attacker could leverage this vulnerability to access and… | ||
| CVE-2026-11980 | Hig | 0.47 | 7.3 | 0.00 | Jul 30, 2026 | IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up. | ||
| CVE-2017-0904 | Hig | 0.46 | 8.1 | 0.02 | Nov 13, 2017 | The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side… |
- risk 0.64cvss 9.8epss 0.01
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands.
- risk 0.64cvss 9.8epss 0.03
modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.
- risk 0.57cvss 8.8epss 0.00
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(...,…
- risk 0.57cvss 8.8epss 0.00
A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to…
- risk 0.57cvss 8.8epss 0.01
Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpeed models.
- risk 0.51cvss 7.8epss 0.00
IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the BinaryFormatter function.
- risk 0.51cvss 7.8epss 0.00
IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the gets function.
- risk 0.51cvss 7.8epss 0.01
The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown.
- risk 0.48cvss 7.4epss 0.01
ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass . An authenticated attacker could leverage this vulnerability to access and…
- risk 0.47cvss 7.3epss 0.00
IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.
- risk 0.46cvss 8.1epss 0.02
The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side…