CWE-908
Use of Uninitialized Resource
Description
The product uses or accesses a resource that has not been initialized.
Hierarchy (View 1000)
CVEs mapped to this weakness (829)
page 10 of 42| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-1206 | Hig | 0.50 | 7.5 | 0.09 | Jun 9, 2020 | An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Information Disclosure Vulnerability'. | ||
| CVE-2026-16386 | Hig | 0.49 | 7.5 | 0.00 | Jul 21, 2026 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||
| CVE-2026-16385 | Hig | 0.49 | 7.5 | 0.00 | Jul 21, 2026 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||
| CVE-2026-16384 | Hig | 0.49 | 7.5 | 0.00 | Jul 21, 2026 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||
| CVE-2026-11576 | Hig | 0.49 | 7.5 | 0.00 | Jun 19, 2026 | The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple… | ||
| CVE-2026-43139 | Hig | 0.49 | 8.6 | 0.00 | May 6, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() xfrm6_get_saddr() does not check the return value of ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable source address (returns… | ||
| CVE-2026-6749 | Hig | 0.49 | 7.5 | 0.00 | Apr 21, 2026 | Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | ||
| CVE-2026-3497 | Hig | 0.49 | 7.5 | 0.02 | Mar 12, 2026 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does… | ||
| CVE-2026-2794 | Hig | 0.49 | 7.5 | 0.00 | Feb 24, 2026 | Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 148. | ||
| CVE-2026-23003 | Hig | 0.49 | 7.5 | 0.00 | Jan 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull(). [1] … | ||
| CVE-2026-0915 | Hig | 0.49 | 7.5 | 0.01 | Jan 15, 2026 | Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver. | ||
| CVE-2025-59964 | Hig | 0.49 | 7.5 | 0.00 | Oct 9, 2025 | A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700 devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When forwarding-options sampling is enabled, receipt of… | ||
| CVE-2025-49718 | Hig | 0.49 | 7.5 | 0.03 | Jul 8, 2025 | Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2023-37930 | Hig | 0.49 | 7.5 | 0.01 | Apr 8, 2025 | Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests. | ||
| CVE-2025-21220 | Hig | 0.49 | 7.5 | 0.02 | Jan 14, 2025 | Microsoft Message Queuing Information Disclosure Vulnerability | ||
| CVE-2018-9381 | Hig | 0.49 | 7.5 | 0.00 | Dec 2, 2024 | In gatts_process_read_by_type_req of gatt_sr.c, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||
| CVE-2024-50241 | Hig | 0.49 | 7.5 | 0.00 | Nov 9, 2024 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Initialize struct nfsd4_copy earlier Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are… | ||
| CVE-2024-38257 | Hig | 0.49 | 7.5 | 0.04 | Sep 10, 2024 | Microsoft AllJoyn API Information Disclosure Vulnerability | ||
| CVE-2024-38064 | Hig | 0.49 | 7.5 | 0.02 | Jul 9, 2024 | Windows TCP/IP Information Disclosure Vulnerability | ||
| CVE-2022-48747 | Hig | 0.49 | 7.5 | 0.01 | Jun 20, 2024 | In the Linux kernel, the following vulnerability has been resolved: block: Fix wrong offset in bio_truncate() bio_truncate() clears the buffer outside of last block of bdev, however current bio_truncate() is using the wrong offset of page. So it can return the uninitialized… |
- risk 0.50cvss 7.5epss 0.09
An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Information Disclosure Vulnerability'.
- risk 0.49cvss 7.5epss 0.00
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
- risk 0.49cvss 7.5epss 0.00
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
- risk 0.49cvss 7.5epss 0.00
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
- risk 0.49cvss 7.5epss 0.00
The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple…
- risk 0.49cvss 8.6epss 0.00
In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() xfrm6_get_saddr() does not check the return value of ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable source address (returns…
- risk 0.49cvss 7.5epss 0.00
Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- risk 0.49cvss 7.5epss 0.02
Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does…
- risk 0.49cvss 7.5epss 0.00
Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 148.
- risk 0.49cvss 7.5epss 0.00
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull(). [1] …
- risk 0.49cvss 7.5epss 0.01
Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.
- risk 0.49cvss 7.5epss 0.00
A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700 devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When forwarding-options sampling is enabled, receipt of…
- risk 0.49cvss 7.5epss 0.03
Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.
- risk 0.49cvss 7.5epss 0.01
Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests.
- risk 0.49cvss 7.5epss 0.02
Microsoft Message Queuing Information Disclosure Vulnerability
- risk 0.49cvss 7.5epss 0.00
In gatts_process_read_by_type_req of gatt_sr.c, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- risk 0.49cvss 7.5epss 0.00
In the Linux kernel, the following vulnerability has been resolved: NFSD: Initialize struct nfsd4_copy earlier Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are…
- risk 0.49cvss 7.5epss 0.04
Microsoft AllJoyn API Information Disclosure Vulnerability
- risk 0.49cvss 7.5epss 0.02
Windows TCP/IP Information Disclosure Vulnerability
- risk 0.49cvss 7.5epss 0.01
In the Linux kernel, the following vulnerability has been resolved: block: Fix wrong offset in bio_truncate() bio_truncate() clears the buffer outside of last block of bdev, however current bio_truncate() is using the wrong offset of page. So it can return the uninitialized…