CWE-252 · Input Validation and Logic
Unchecked Return Value
182CVEs
0exploited
0with a public check
3likely (EPSS 10%+)
SortMost likely exploited
182 CVEs with CWE-252 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2005-4360The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll…Microsoft · Internet Information Services · 2005-12-20 | – | 87% | 2005-12-20 |
| CVE-2007-3798Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an…Tcpdump · Tcpdump · CVSS 9.8 · 2007-07-16 | 9.8 | 70% | 2007-07-16 |
| CVE-2010-0211The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a deni…Openldap · Openldap · 2010-07-27 | – | 28% | 2010-07-27 |
| CVE-2019-10902In Wireshark 3.0.0, the TSDNS dissector could crash. This was addressed in epan/dissectors/packet-tsdns.c by splitting strings safely.Wireshark · Wireshark · 2019-04-09 | – | 4.7% | 2019-04-09 |
| CVE-2018-20216QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled).Qemu · Qemu · 2018-12-20 | – | 3.9% | 2018-12-20 |
| CVE-2018-14622A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a…Libtirpc Project · libtirpc · CVSS 5.3 · 2018-08-30 | 5.3 | 3.9% | 2018-08-30 |
| CVE-2020-17533Apache Accumulo Improper Handling of Insufficient PermissionsApache Software Foundation · Apache Accumulo · 2020-12-29 | – | 3.7% | 2020-12-29 |
| CVE-2021-4189A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV r…Siemens · python · CVSS 5.3 · 2022-08-24 | 5.3 | 3.6% | 2022-08-24 |
| CVE-2018-14367In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was addressed in epan/dissectors/packet-coap.c by properly checking for a NULL condit…Wireshark · Wireshark · 2018-07-19 | – | 3.3% | 2018-07-19 |
| CVE-2020-6078An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdns_recv, the return valu…Videolabs · Videolabs · CVSS 7.5 · 2020-03-24 | 7.5 | 3.1% | 2020-03-24 |
| CVE-2018-16643The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check th…Imagemagick · Imagemagick · 2018-09-06 | – | 3.1% | 2018-09-06 |
| CVE-2022-23806Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.Golang · Go · 2022-02-11 | – | 3.1% | 2022-02-11 |
| CVE-2019-12107The upnp_event_prepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper validation of an snpri…Miniupnp.free · Miniupnpd · 2019-05-15 | – | 3.0% | 2019-05-15 |
| CVE-2002-1372Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, which could allow a remote attacker to ca…Apple · Cups · CVSS 7.5 · 2004-09-01 | 7.5 | 3.0% | 2004-09-01 |
| CVE-2016-10061The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial…Imagemagick · Imagemagick · 2017-03-03 | – | 2.9% | 2017-03-03 |
| CVE-2009-0265Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypas…Isc · Bind · 2009-01-26 | – | 2.5% | 2009-01-26 |
| CVE-2021-38171adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits…Ffmpeg · Ffmpeg · 2021-08-21 | – | 2.4% | 2021-08-21 |
| CVE-1999-0199manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attac…Gnu · Glibc · 2020-10-06 | – | 2.4% | 2020-10-06 |
| CVE-2016-10060The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to ca…Imagemagick · Imagemagick · 2017-03-02 | – | 2.3% | 2017-03-02 |
| CVE-2019-17178HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer (i…Freerdp · Freerdp · 2019-10-04 | – | 2.3% | 2019-10-04 |
| CVE-2021-42780A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library.Opensc Project · opensc · 2022-04-18 | – | 2.2% | 2022-04-18 |
| CVE-2021-28875In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.Rust-Lang · Rust · 2021-04-11 | – | 2.1% | 2021-04-11 |
| CVE-2019-15900An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum(3), sscanf was used without checking for error cases. In…Doas Project · Doas · 2019-10-18 | – | 2.1% | 2019-10-18 |
| CVE-2019-15942FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645_parse because alloc_rbsp_buffer in libavcodec/h2645_parse.c mishandles rbsp_buffe…Ffmpeg · Ffmpeg · 2019-09-05 | – | 2.0% | 2019-09-05 |
| CVE-2020-6152A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A specially crafted malformed file can cause an out-of-bounds wr…Accusoft · Accusoft · CVSS 9.8 · 2020-09-01 | 9.8 | 1.9% | 2020-09-01 |
| CVE-2022-23476Unchecked return value from xmlTextReaderExpand in Nokogirisparklemotion · nokogiri · CVSS 7.5 · 2022-12-08 | 7.5 | 1.8% | 2022-12-08 |
| CVE-2021-26955An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecke…Xcb Project · Xcb · 2021-02-09 | – | 1.7% | 2021-02-09 |
| CVE-2022-1319A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the…Redhat · undertow · 2022-08-31 | – | 1.7% | 2022-08-31 |
| CVE-2021-21217Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF fil…Google · Chrome · 2021-04-26 | – | 1.6% | 2021-04-26 |
| CVE-2021-26958An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event u…Xcb Project · Xcb · 2021-02-09 | – | 1.6% | 2021-02-09 |
| CVE-2017-0720A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37430213.Google Inc. · Android · 2017-08-09 | – | 1.6% | 2017-08-09 |
| CVE-2021-28906In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of re…Cesnet · Libyang · 2021-05-20 | – | 1.6% | 2021-05-20 |
| CVE-2024-50306Apache Traffic Server: Server process can fail to drop privilegeApache Software Foundation · Apache Traffic Server · CVSS 9.1 · 2024-11-14 | 9.1 | 1.6% | 2024-11-14 |
| CVE-2021-28902In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation…Cesnet · Libyang · 2021-05-20 | – | 1.6% | 2021-05-20 |
| CVE-2022-40279An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/src/l2_packet/l2_packet_pcap.c has a missing check on the ret…Samsung · Tizenrt · 2022-09-08 | – | 1.5% | 2022-09-08 |
| CVE-2020-4531IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detai…IBM · Business Automation Workflow · CVSS 5.3 · 2020-09-25 | 5.3 | 1.4% | 2020-09-25 |
| CVE-2019-15523An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It negle…Linbit · Csync2 · 2020-12-30 | – | 1.4% | 2020-12-30 |
| CVE-2023-6918Libssh: missing checks for return values for digestsRed Hat · Red Hat Enterprise Linux 8 · CVSS 3.7 · 2023-12-18 | 3.7 | 1.4% | 2023-12-18 |
| CVE-2021-28904In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].…Cesnet · Libyang · 2021-05-20 | – | 1.4% | 2021-05-20 |
| CVE-2021-40401A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-cr…Gerbv Project · Gerbv · CVSS 10 · 2022-02-04 | 10.0 | 1.3% | 2022-02-04 |
| CVE-2024-0743An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.9, and Thunderbird <…Mozilla · Firefox · CVSS 7.5 · 2024-01-23 | 7.5 | 1.3% | 2024-01-23 |
| CVE-2022-0907Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libti…libtiff · libtiff · CVSS 5.5 · 2022-03-11 | 5.5 | 1.3% | 2022-03-11 |
| CVE-2021-21219Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF fil…Google · Chrome · 2021-04-26 | – | 1.2% | 2021-04-26 |
| CVE-2021-29739IBM Planning Analytics Local 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. X-Force ID: 198846.IBM · Planning Analytics Local · CVSS 2.7 · 2021-08-10 | 2.7 | 1.1% | 2021-08-10 |
| CVE-2022-40716HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privil…Hashicorp · Consul · CVSS 6.5 · 2022-09-23 | 6.5 | 1.1% | 2022-09-23 |
| CVE-2021-41041In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation,…The Eclipse Foundation · Eclipse OpenJ9 · 2022-04-27 | – | 1.1% | 2022-04-27 |
| CVE-2022-21211Denial of Service (DoS)Posix Project · posix · CVSS 5.9 · 2022-06-10 | 5.9 | 1.1% | 2022-06-10 |
| CVE-2026-0723Unchecked Return Value in GitLabGitLab · GitLab · CVSS 7.4 · 2026-01-22 | 7.4 | 1.0% | 2026-01-22 |
| CVE-2022-0485A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the completion of an asy…Redhat · libnbd · 2022-08-29 | – | 1.0% | 2022-08-29 |
| CVE-2020-27898A denial of service issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1. An attacker may be able to bypass Managed Frame Protection.Apple · macOS · 2020-12-08 | – | 1.0% | 2020-12-08 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.