Weaknesses of type CWE-226

37 results

Informação sensível não removida antes de reutilizar recurso

Ocorre quando dados sensíveis (senhas, tokens, chaves, PII) permanecem em memória, disco ou outro recurso após seu uso e esse recurso é reutilizado ou alocado a outro contexto. Um atacante com acesso a esse recurso consegue recuperar a informação confidencial que deveria ter sido apagada.

Example

Uma aplicação aloca um buffer para processar um arquivo de configuração contendo senha de banco de dados, mas ao terminar reutiliza esse mesmo buffer sem limpá-lo. Se o buffer for posteriormente alocado a outro usuário ou processo, a senha anterior fica acessível.

How to mitigate

Sempre sobrescrever memória contendo dados sensíveis com zeros ou padrões aleatórios imediatamente após o uso, antes de liberar o recurso. Use funções específicas para limpeza segura (como `memset_s` em C, ou mecanismos de linguagem que garantem zeroing) e implemente auditoria de alocação de recursos críticos.

CVE-2025-13108MEDIUMFixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and WindowsEPSS 0.2%CVE-2019-25563MEDIUMPCHelpWareV2 1.0.0.5 Denial of Service via SC CreationEPSS 0.2%CVE-2019-25571MEDIUMMediaMonkey 4.1.23 Denial of Service via Malformed URLEPSS 0.2%CVE-2023-41138HIGHThe AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user pEPSS 0.2%CVE-2019-25645MEDIUMWinAVI iPod 3GP MP4 PSP Converter 4.4.2 Denial of ServiceEPSS 0.2%CVE-2025-0647HIGHIn certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to thEPSS 0.2%CVE-2019-25553MEDIUMCEWE PHOTO IMPORTER 6.4.3 Denial of Service via Malformed ImageEPSS 0.2%CVE-2026-13585HIGHAllocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System ContEPSS 0.2%CVE-2026-48984MEDIUMpam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heapEPSS 0.1%CVE-2025-33196MEDIUMNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploiEPSS 0.1%CVE-2025-33200LOWNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploiEPSS 0.1%CVE-2025-33198LOWNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploiEPSS 0.1%CVE-2025-20622LOWSensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023 EPSS 0.1%CVE-2019-25617MEDIUMEase Audio Converter 5.30 Denial of Service via Audio CutterEPSS 0.1%CVE-2025-14858MEDIUMSemtech LR11xx Encrypted Firmware DisclosureEPSS 0.1%CVE-2025-48066MEDIUMwire-webapp has no database deletion on client logoutEPSS 0.1%CVE-2026-18023MEDIUMSensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive informatioEPSS 0.1%