Use of Potentially Dangerous Function
CWE-676
The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.2.
How this weakness is prevented
- Build and Compilation Implementation: Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the banned.h include file from Microsoft's SDL.
Latest Use of Potentially Dangerous Function vulnerabilities
- 8.6 High severity
vsDesk: Use of Potentially Dangerous Function
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operatio
- 9.8 Critical severity
Db2 Genius Hub: Use of Potentially Dangerous Function
IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions.
- 7.5 High severity
stanza: Deserialization of Untrusted Data
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) bu
- 7.7 High severity
Process Optimization: Use of Potentially Dangerous Function
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a victim user who subsequently interacts with the graphical elemen
- 7.5 High severity
Open5GS: Use of Potentially Dangerous Function
When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data from incomin