Weaknesses of type CWE-665

148 results

Inicialização incorreta ou ausente de recurso

Ocorre quando um recurso (variável, estrutura, arquivo, conexão) não é inicializado ou recebe um valor inicial incorreto antes do uso. O código acessa ou manipula o recurso em um estado indefinido, levando a comportamentos imprevisíveis, corrupção de dados ou falhas de segurança.

Example

Um buffer alocado dinamicamente que nunca recebe um valor inicial é processado como se contivesse dados válidos; ou um ponteiro não é definido como NULL antes de ser verificado, causando derreferenciação de endereço inválido. Em contexto de credenciais: uma struct de sessão alocada mas não zerada retém dados de uma sessão anterior.

How to mitigate

Sempre inicializar recursos explicitamente no ponto de declaração ou alocação (ex: `int var = 0;`, `memset(struct, 0, sizeof(struct))`, construtores em C++). Use linters e análise estática para detectar variáveis não inicializadas antes do uso.

CVE-2022-0847HIGHA flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe EPSS 88.6%KEVCVE-2022-22719—mod_lua Use of uninitialized value of in r:parsebodyEPSS 69.8%CVE-2022-46164CRITICALAccount takeover via prototype vulnerabilityEPSS 49.0%CVE-2020-27950MEDIUMA memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security UEPSS 16.5%KEVCVE-2018-14647MEDIUMPython's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial oEPSS 11.3%CVE-2013-1675MEDIUMMozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properEPSS 6.7%KEVCVE-2018-10915HIGHA vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between coEPSS 5.2%CVE-2023-1719HIGHBitrix24 Insecure Global Variable ExtractionEPSS 5.0%CVE-2022-21724HIGHUnchecked Class Instantiation when providing Plugin ClassesEPSS 3.0%CVE-2019-8259—UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be EPSS 3.0%CVE-2022-36364—Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vectorEPSS 3.0%CVE-2019-8277—UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can beEPSS 3.0%CVE-2019-15681—LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker tEPSS 2.9%CVE-2018-14282—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 2.8%CVE-2018-10484—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.7%CVE-2018-1175—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User iEPSS 2.7%CVE-2018-1174—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User iEPSS 2.6%CVE-2019-1840HIGHCisco Prime Network Registrar Denial of Service VulnerabilityEPSS 2.4%CVE-2016-9594MEDIUMcurl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. EPSS 2.3%CVE-2020-10725HIGHA flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend appliEPSS 2.2%