Common Weakness Enumeration
CWE-252
AllowedUnchecked Return Value
Abstraction: Base · Status: Draft
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
235 vulnerabilities reference this CWE, most recent first.
GHSA-X68J-PWCM-V888
Vulnerability from github – Published: 2022-02-10 00:00 – Updated: 2022-04-20 00:01
VLAI
Details
A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2021-40401"
],
"database_specific": {
"cwe_ids": [
"CWE-252",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-04T23:15:00Z",
"severity": "HIGH"
},
"details": "A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.",
"id": "GHSA-x68j-pwcm-v888",
"modified": "2022-04-20T00:01:31Z",
"published": "2022-02-10T00:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40401"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUM5GIUZJ7AVHVCXDZW6ZVCAPV2ISN47"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1415"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5306"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X6MX-7FCG-2J6W
Vulnerability from github – Published: 2022-05-01 18:31 – Updated: 2025-04-09 03:46
VLAI
Details
mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.
{
"affected": [],
"aliases": [
"CVE-2007-5191"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-10-04T16:17:00Z",
"severity": "HIGH"
},
"details": "mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.",
"id": "GHSA-x6mx-7fcg-2j6w",
"modified": "2025-04-09T03:46:52Z",
"published": "2022-05-01T18:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5191"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=320041"
},
{
"type": "WEB",
"url": "https://issues.rpath.com/browse/RPL-1757"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10101"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00144.html"
},
{
"type": "WEB",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=195390"
},
{
"type": "WEB",
"url": "http://frontal2.mandriva.com/en/security/advisories?name=MDKSA-2007:198"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git%3Ba=commit%3Bh=ebbeb2c7ac1b00b6083905957837a271e80b187e"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git;a=commit;h=ebbeb2c7ac1b00b6083905957837a271e80b187e"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
},
{
"type": "WEB",
"url": "http://lists.vmware.com/pipermail/security-announce/2008/000002.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27104"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27122"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27145"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27188"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27283"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27354"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27399"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27687"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28348"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28349"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28368"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28469"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200710-18.xml"
},
{
"type": "WEB",
"url": "http://support.avaya.com/elmodocs2/security/ASA-2008-023.htm"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2008/dsa-1449"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2008/dsa-1450"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2007-0969.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/485936/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/486859/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/25973"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1018782"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-533-1"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2008-0001.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/3417"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/0064"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-X8RH-6X6W-X2XG
Vulnerability from github – Published: 2024-07-29 18:30 – Updated: 2024-07-30 21:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
set_memory_rox() can fail, leaving memory unprotected.
Check return and bail out when bpf_jit_binary_lock_ro() returns an error.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-42067"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T16:15:06Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()\n\nset_memory_rox() can fail, leaving memory unprotected.\n\nCheck return and bail out when bpf_jit_binary_lock_ro() returns\nan error.",
"id": "GHSA-x8rh-6x6w-x2xg",
"modified": "2024-07-30T21:31:25Z",
"published": "2024-07-29T18:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42067"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/044da7ae7afd4ef60806d73654a2e6a79aa4ed7a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/08f6c05feb1db21653e98ca84ea04ca032d014c7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9fef36cad60d4226f9d06953cd56d1d2f9119730"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e60adf513275c3a38e5cb67f7fd12387e43a3ff5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XRR8-P4PF-HFWR
Vulnerability from github – Published: 2025-04-16 15:34 – Updated: 2026-06-19 15:33
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
nfsd: don't ignore the return code of svc_proc_register()
Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel will WARN when it tries to remove the entry later.
Fix nfsd_proc_stat_init() to return the same type of pointer as svc_proc_register(), and fix up nfsd_net_init() to check that and fail the nfsd_net construction if it occurs.
svc_proc_register() can fail if the dentry can't be allocated, or if an identical dentry already exists. The second case is pretty unlikely in the nfsd_net construction codepath, so if this happens, return -ENOMEM.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-22026"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T15:15:55Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: don\u0027t ignore the return code of svc_proc_register()\n\nCurrently, nfsd_proc_stat_init() ignores the return value of\nsvc_proc_register(). If the procfile creation fails, then the kernel\nwill WARN when it tries to remove the entry later.\n\nFix nfsd_proc_stat_init() to return the same type of pointer as\nsvc_proc_register(), and fix up nfsd_net_init() to check that and fail\nthe nfsd_net construction if it occurs.\n\nsvc_proc_register() can fail if the dentry can\u0027t be allocated, or if an\nidentical dentry already exists. The second case is pretty unlikely in\nthe nfsd_net construction codepath, so if this happens, return -ENOMEM.",
"id": "GHSA-xrr8-p4pf-hfwr",
"modified": "2026-06-19T15:33:07Z",
"published": "2025-04-16T15:34:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22026"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/30405b23b4d5e2a596fb756d48119d7293194e75"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/51107e768de6821b68aa34a136d07bc7a09cf6c3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/51da899c209a9624e48be416bd30e7ed5cd6c3d8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6a59b70fe71ec66c0dd19e2c279c71846a3fb2f0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/930b64ca0c511521f0abdd1d57ce52b2a6e3476b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9d9456185fd5f1891c74354ee297f19538141ead"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e31957a819e60cf0bc9a49408765e6095fd3d046"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e4316bd85e42b01125b2aab691769234a388b8a3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XW6G-JJVF-WWF9
Vulnerability from github – Published: 2022-06-20 22:25 – Updated: 2022-06-20 22:25
VLAI
Summary
Invalid file request can crash server
Details
Impact
Certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as a single instance without redundancy, the availability impact may be high.
Patches
To prevent this, invalid requests are now properly handled.
Workarounds
None
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9
- https://github.com/parse-community/parse-server
For more information
- For questions or comments about this vulnerability visit our community forum or community chat
- Report other vulnerabilities at report.parseplatform.org
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.10.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31089"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-20T22:25:46Z",
"nvd_published_at": "2022-06-27T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nCertain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as a single instance without redundancy, the availability impact may be high.\n\n### Patches\nTo prevent this, invalid requests are now properly handled.\n\n### Workarounds\nNone\n\n### References\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9\n- https://github.com/parse-community/parse-server\n\n### For more information\n- For questions or comments about this vulnerability visit our [community forum](http://community.parseplatform.org/) or [community chat](http://chat.parseplatform.org/)\n- Report other vulnerabilities at [report.parseplatform.org](https://report.parseplatform.org/)\n",
"id": "GHSA-xw6g-jjvf-wwf9",
"modified": "2022-06-20T22:25:46Z",
"published": "2022-06-20T22:25:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31089"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/commit/5be375dec2fa35425c1003ae81c55995ac72af92"
},
{
"type": "PACKAGE",
"url": "https://github.com/parse-community/parse-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Invalid file request can crash server"
}
Mitigation MIT-53
Implementation
Check the results of all functions that return a value and verify that the value is expected.
Mitigation MIT-56
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Implementation
Ensure that you account for all possible return values from the function.
Mitigation
Implementation
When designing a function, make sure you return a value or throw an exception in case of an error.
No CAPEC attack patterns related to this CWE.