Use of Inherently Dangerous Function
CWE-242
The product calls a function that can never be guaranteed to work safely, regardless of how it is used.
We track 6 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6.
How this weakness is prevented
- Build and Compilation Implementation: Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the banned.h include file from Microsoft's SDL.
- Testing: Use grep or static analysis tools to spot usage of dangerous functions.
Latest Use of Inherently Dangerous Function vulnerabilities
- 8.8 High severity
PostgreSQL: Use of Inherently Dangerous Function
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like get
- 7.8 High severity
Cognos Command Center: Use of Inherently Dangerous Function
IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the BinaryFormatter function.
- 8.8 High severity
Trend Micro Endpoint Encryption Policy Server: Improper Neutralization of Special Elements used in an SQL Command
A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the t
- 7.8 High severity
CICS TX Standard: Use of Inherently Dangerous Function
IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the gets function.
- 9.8 Critical severity
Reyee OS: Use of Inherently Dangerous Function
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands.
- 8.8 High severity
AirVelocity: Use of Inherently Dangerous Function
Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpee