Weaknesses of type CWE-226

42 results

Informação sensível não removida antes de reutilizar recurso

Ocorre quando dados sensíveis (senhas, tokens, chaves, PII) permanecem em memória, disco ou outro recurso após seu uso e esse recurso é reutilizado ou alocado a outro contexto. Um atacante com acesso a esse recurso consegue recuperar a informação confidencial que deveria ter sido apagada.

Example

Uma aplicação aloca um buffer para processar um arquivo de configuração contendo senha de banco de dados, mas ao terminar reutiliza esse mesmo buffer sem limpá-lo. Se o buffer for posteriormente alocado a outro usuário ou processo, a senha anterior fica acessível.

How to mitigate

Sempre sobrescrever memória contendo dados sensíveis com zeros ou padrões aleatórios imediatamente após o uso, antes de liberar o recurso. Use funções específicas para limpeza segura (como `memset_s` em C, ou mecanismos de linguagem que garantem zeroing) e implemente auditoria de alocação de recursos críticos.

CVE-2026-32960HIGHSD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuEPSS 0.3%CVE-2023-1637MEDIUMA flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power managementEPSS 0.2%CVE-2025-13108MEDIUMFixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and WindowsEPSS 0.2%CVE-2026-107315MEDIUMpgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)EPSS 0.2%CVE-2024-21850HIGHSensitive information in resource not removed before reuse in some Intel(R) TDX Seamldr module software before version 1.5.02.00 may allow aEPSS 0.2%CVE-2019-25657MEDIUMAnyBurn 4.3 x86 Denial of Service via Image ConversionEPSS 0.2%CVE-2019-25571MEDIUMMediaMonkey 4.1.23 Denial of Service via Malformed URLEPSS 0.2%CVE-2019-25563MEDIUMPCHelpWareV2 1.0.0.5 Denial of Service via SC CreationEPSS 0.2%CVE-2019-25645MEDIUMWinAVI iPod 3GP MP4 PSP Converter 4.4.2 Denial of ServiceEPSS 0.2%CVE-2023-41138HIGHThe AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user pEPSS 0.2%CVE-2019-25553MEDIUMCEWE PHOTO IMPORTER 6.4.3 Denial of Service via Malformed ImageEPSS 0.2%CVE-2025-0647HIGHIn certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to thEPSS 0.2%CVE-2026-13585HIGHAllocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System ContEPSS 0.2%CVE-2025-33196MEDIUMNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploiEPSS 0.1%CVE-2026-48984MEDIUMpam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heapEPSS 0.1%CVE-2025-33200LOWNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploiEPSS 0.1%CVE-2025-33198LOWNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploiEPSS 0.1%CVE-2025-20622LOWSensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023 EPSS 0.1%CVE-2019-25617MEDIUMEase Audio Converter 5.30 Denial of Service via Audio CutterEPSS 0.1%CVE-2026-18023MEDIUMSensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive informatioEPSS 0.1%