1098
Reference Description
CVE-2019-15900 Chain: sscanf() call is used to check if a username and group exists, but the
return value of sscanf() call is not checked (CWE-252), causing an uninitialized
variable to be checked (CWE-457), returning success to allow authorization
bypass for executing a privileged (CWE-863).
https://www.cve.org/CVERecord?id=CVE-2019-15900
CVE-2008-3688 Chain: A denial of service may be caused by an uninitialized variable
(CWE-457) allowing an infinite loop (CWE-835) resulting from a connection to
an unresponsive server.
https://www.cve.org/CVERecord?id=CVE-2008-3688
CVE-2008-0081 Uninitialized variable leads to code execution in popular desktop application.
https://www.cve.org/CVERecord?id=CVE-2008-0081
CVE-2007-4682 Crafted input triggers dereference of an uninitialized object pointer.
https://www.cve.org/CVERecord?id=CVE-2007-4682
CVE-2007-3468 Crafted audio file triggers crash when an uninitialized variable is used.
https://www.cve.org/CVERecord?id=CVE-2007-3468
CVE-2007-2728 Uninitialized random seed variable used.
https://www.cve.org/CVERecord?id=CVE-2007-2728
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 398 7PK - Code Quality 700 2323
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1180 SEI CERT Perl Coding Standard - Guidelines 02.
Declarations and Initialization (DCL)
1178 2465
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Uninitialized variable
7 Pernicious Kingdoms Uninitialized Variable
Software Fault Patterns SFP1 Glitch in computation
SEI CERT Perl Coding
Standard
DCL33-
PL
Imprecise Declare identifiers before using them
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-436]mercy. "Exploiting Uninitialized Data". 2006 January. < http://www.felinemenace.org/
~mercy/papers/UBehavior/UBehavior.zip >.
[REF-437]Microsoft Security Vulnerability Research & Defense. "MS08-014 : The Case of
the Uninitialized Stack Variable Vulnerability". 2008 March 1. < https://msrc.microsoft.com/
blog/2008/03/ms08-014-the-case-of-the-uninitialized-stack-variable-vulnerability/ >.2023-04-07.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE Version 4.14
CWE-459: Incomplete Cleanup
CWE-459: Incomplete Cleanup