Weaknesses of type CWE-399

160 results

Erros de Gestão de Recursos

É quando o código falha em alocar, usar ou liberar corretamente recursos do sistema (memória, conexões, arquivos, sockets, threads). O resultado é vazamento de recursos, esgotamento de limites do sistema ou comportamento imprevisível que abre portas para negação de serviço ou exploração.

Example

Uma aplicação web abre uma conexão com banco de dados em cada requisição, mas não a fecha quando ocorre uma exceção. Depois de centenas de requisições, o pool de conexões está saturado e novas requisições falham, derrubando o serviço.

How to mitigate

Use padrões de cleanup garantido (try-finally, context managers, RAII) para liberar recursos. Implemente monitoramento de limites de recursos e testes de carga que exponham vazamentos antes da produção.

CVE-2017-3790—A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software coEPSS 3.5%CVE-2018-0421—Cisco Prime Access Registrar Denial of Service VulnerabilityEPSS 3.5%CVE-2018-0332—A vulnerability in the Session Initiation Protocol (SIP) ingress packet processing of Cisco Unified IP Phone software could allow an unautheEPSS 3.4%CVE-2018-0443HIGHCisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Denial of Service VulnerabilityEPSS 3.4%CVE-2022-20625MEDIUMCisco FXOS and NX-OS Software Cisco Discovery Protocol Service Denial of Service VulnerabilityEPSS 3.3%CVE-2018-0273—A vulnerability in the IPsec Manager of Cisco StarOS for Cisco Aggregation Services Router (ASR) 5000 Series Routers and Virtualized Packet EPSS 3.2%CVE-2018-0286—A vulnerability in the netconf interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of serviEPSS 3.2%CVE-2017-12250—A vulnerability in the HTTP web interface for Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker toEPSS 3.1%CVE-2017-12355—A vulnerability in the Local Packet Transport Services (LPTS) ingress frame-processing functionality of Cisco IOS XR Software could allow anEPSS 3.1%CVE-2018-15458MEDIUMCisco Firepower Management Center Disk Utilization Denial of Service VulnerabilityEPSS 3.1%CVE-2017-6610—A vulnerability in the Internet Key Exchange Version 1 (IKEv1) XAUTH code of Cisco ASA Software could allow an authenticated, remote attackeEPSS 3.0%CVE-2016-6368—A vulnerability in the detection engine parsing of Pragmatic General Multicast (PGM) protocol packets for Cisco Firepower System Software coEPSS 3.0%CVE-2017-6609—A vulnerability in the IPsec code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of the affected systEPSS 2.8%CVE-2018-0311—A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remotEPSS 2.8%CVE-2019-12652HIGHCisco Catalyst 4000 Series Switches TCP Denial of Service VulnerabilityEPSS 2.7%CVE-2017-3864—A vulnerability in the DHCP client implementation of Cisco IOS (12.2, 12.4, and 15.0 through 15.6) and Cisco IOS XE (3.3 through 3.7) could EPSS 2.7%CVE-2017-12219—A vulnerability in the handling of IP fragments for the Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones could allow an unauEPSS 2.7%CVE-2016-9225—A vulnerability in the data plane IP fragment handler of the Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security module could EPSS 2.7%CVE-2017-3857—A vulnerability in the Layer 2 Tunneling Protocol (L2TP) parsing function of Cisco IOS (12.0 through 12.4 and 15.0 through 15.6) and Cisco IEPSS 2.6%CVE-2019-1718MEDIUMCisco Identity Services Engine SSL Renegotiation Denial of Service VulnerabilityEPSS 2.5%