VYPR

CWE-252

Unchecked Return Value

BaseDraftLikelihood: Low

Description

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Two common programmer assumptions are "this function call can never fail" and "it doesn't matter if this function call fails". If an attacker can force the function to fail or otherwise return a value that is not expected, then the subsequent program logic could lead to a vulnerability, because the product is not in a state that the programmer assumes. For example, if the program calls a function to drop privileges but does not check the return code to ensure that privileges were successfully dropped, then the program will continue to operate with the higher privileges.

Hierarchy (View 1000)

Parents

Children

CVEs mapped to this weakness (176)

page 9 of 9
  • CVE-2022-23495HigDec 8, 2022
    risk 0.00cvss 7.5epss 0.01

    go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error…

  • CVE-2022-1319HigAug 31, 2022
    risk 0.00cvss 7.5epss 0.01

    A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in…

  • CVE-2022-0485MedAug 29, 2022
    risk 0.00cvss 4.8epss 0.01

    A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as successful, rather than checking the *error parameter. This could result in the…

  • CVE-2021-4189MedAug 24, 2022
    risk 0.00cvss 5.3epss 0.03

    A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP…

  • CVE-2021-3659MedAug 22, 2022
    risk 0.00cvss 5.5epss 0.00

    A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system…

  • CVE-2021-41041MedApr 27, 2022
    risk 0.00cvss 5.3epss 0.01

    In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.

  • CVE-2021-42780MedApr 18, 2022
    risk 0.00cvss 5.3epss 0.02

    A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library.

  • CVE-2021-38171CriAug 21, 2021
    risk 0.00cvss 9.8epss 0.02

    adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted.

  • CVE-2021-37625HigAug 5, 2021
    risk 0.00cvss 7.5epss 0.01

    Skytable is an open source NoSQL database. In versions prior to 0.6.4 an incorrect check of return value of the accept function in the run-loop for a TCP socket/TLS socket/TCP+TLS multi-socket causes an early exit from the run loop that should continue infinitely unless…

  • CVE-2021-38114MedAug 4, 2021
    risk 0.00cvss 5.5epss 0.01

    libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868.

  • CVE-2021-28675MedJun 2, 2021
    risk 0.00cvss 5.5epss 0.01

    An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.

  • CVE-2021-28875HigApr 11, 2021
    risk 0.00cvss 7.5epss 0.02

    In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.

  • CVE-2019-15900CriOct 18, 2019
    risk 0.00cvss 9.8epss 0.02

    An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if…

  • CVE-2019-12107HigMay 15, 2019
    risk 0.00cvss 7.5epss 0.03

    The upnp_event_prepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper validation of an snprintf return value.

  • CVE-2018-16643MedSep 6, 2018
    risk 0.00cvss 6.5epss 0.03

    The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc function, which allows remote attackers to cause a denial of service via…

  • CVE-2007-5191Oct 4, 2007
    risk 0.00cvss epss 0.00

    mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.