Weaknesses of type CWE-399

160 results

Erros de Gestão de Recursos

É quando o código falha em alocar, usar ou liberar corretamente recursos do sistema (memória, conexões, arquivos, sockets, threads). O resultado é vazamento de recursos, esgotamento de limites do sistema ou comportamento imprevisível que abre portas para negação de serviço ou exploração.

Example

Uma aplicação web abre uma conexão com banco de dados em cada requisição, mas não a fecha quando ocorre uma exceção. Depois de centenas de requisições, o pool de conexões está saturado e novas requisições falham, derrubando o serviço.

How to mitigate

Use padrões de cleanup garantido (try-finally, context managers, RAII) para liberar recursos. Implemente monitoramento de limites de recursos e testes de carga que exponham vazamentos antes da produção.

CVE-2020-3351HIGHCisco SD-WAN Solution Software Denial of Service VulnerabilityEPSS 1.4%CVE-2022-20715HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Access SSL VPN Denial of Service VulnerabilityEPSS 1.3%CVE-2021-1611HIGHCisco IOS XE Software for Catalyst 9800 Series Wireless Controllers EoGRE Denial of Service VulnerabilityEPSS 1.3%CVE-2021-1624HIGHCisco IOS XE Software Rate Limiting Network Address Translation Denial of Service VulnerabilityEPSS 1.3%CVE-2019-16020HIGHCisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesEPSS 1.3%CVE-2019-16022HIGHCisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesEPSS 1.3%CVE-2019-16023HIGHCisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesEPSS 1.3%CVE-2019-16019HIGHCisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesEPSS 1.3%CVE-2018-0272—A vulnerability in the Secure Sockets Layer (SSL) Engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker EPSS 1.3%CVE-2018-0380—Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format (ARF) and Webex Recording Format (WEPSS 1.3%CVE-2021-1394MEDIUMCisco IOS XE Software for Network Convergence System 520 Routers Denial of Service VulnerabilityEPSS 1.3%CVE-2020-3303MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software IKEv1 Denial of Service VulnerabilityEPSS 1.2%CVE-2022-20758MEDIUMCisco IOS XR Software Border Gateway Protocol Ethernet VPN Denial of Service VulnerabilityEPSS 1.2%CVE-2019-1587MEDIUMCisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Filter Query Information Disclosure VulnerabilityEPSS 1.2%CVE-2021-40122MEDIUMCisco Meeting Server Call Bridge Denial of Service VulnerabilityEPSS 1.2%CVE-2022-20847HIGHCisco IOS XE Wireless Controller Software for the Catalyst 9000 Family DHCP Processing Denial of Service VulnerabilityEPSS 1.2%CVE-2018-15390—Cisco Firepower Threat Defense Software FTP Inspection Denial of Service VulnerabilityEPSS 1.1%CVE-2021-1623HIGHCisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers Simple Network Management Protocol Denial of Service VulnerabilityEPSS 1.1%CVE-2019-12665MEDIUMCisco IOS and IOS XE Software HTTP Client Information Disclosure VulnerabilityEPSS 1.1%CVE-2018-15404—Cisco Integrated Management Controller Supervisor and Cisco UCS Director System Resources Denial of Service VulnerabilityEPSS 1.1%