Weaknesses of type CWE-457

245 results

Uso de variável não inicializada

Ocorre quando o código lê o valor de uma variável antes de atribuir um valor explícito a ela. Dependendo do contexto (memória da stack, heap, ou dados globais), a variável contém lixo de memória, levando a comportamentos impredizíveis: crashes, vazamento de informações ou execução descontrolada.

Example

Um programa aloca um buffer na stack e o passa para uma função sem preenchê-lo antes. Se a função escrever dados sensíveis nesse espaço e depois enviá-lo pela rede, credenciais ou tokens anteriormente na memória podem ser expostos. Ou a leitura do valor lixo causa uma condição de corrida ou salto de endereço inválido.

How to mitigate

Inicialize todas as variáveis no ponto de declaração (int x = 0; char buf[256] = {0};). Use ferramentas de análise estática (cppcheck, clang-tidy) e sanitizers do compilador (-fsanitize=memory no GCC/Clang) para detectar usos antes da inicialização. Em linguagens de nível mais alto, confie no zeroing automático fornecido pelo runtime.

CVE-2023-31192MEDIUMAn information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network EPSS 1.0%CVE-2024-32611CRITICALHDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c.EPSS 1.0%CVE-2022-28319HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034.EPSS 0.9%CVE-2022-28320HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interactioEPSS 0.9%CVE-2024-26147HIGHHelm's Missing YAML Content Leads To PanicEPSS 0.9%CVE-2024-6990HIGHUninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds EPSS 0.9%CVE-2020-27124HIGHCisco Adaptive Security Appliance Software SSL/TLS Denial of Service VulnerabilityEPSS 0.9%CVE-2021-44003—A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_LoadeEPSS 0.8%CVE-2022-34655HIGHTMM vulnerability CVE-2022-34655EPSS 0.7%CVE-2023-6324HIGHThroughTek Kalay SDK error in handling the PSK identityEPSS 0.7%CVE-2024-26882HIGHnet: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()EPSS 0.7%CVE-2025-20212HIGHA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remoteEPSS 0.7%CVE-2022-28317HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 0.6%CVE-2026-91963HIGHFreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrcEPSS 0.6%CVE-2025-54874MEDIUMOpenJPEG allows OOB heap memory write in opj_jp2_read_headerEPSS 0.6%CVE-2021-3928HIGHUse of Uninitialized Variable in vim/vimEPSS 0.6%CVE-2022-42432MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attackEPSS 0.6%CVE-2025-56364HIGHA use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().ValueEPSS 0.6%CVE-2025-20271HIGHCisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service VulnerabilityEPSS 0.5%CVE-2024-29838HIGHUnsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crashEPSS 0.5%