Weaknesses of type CWE-665

153 results

Inicialização incorreta ou ausente de recurso

Ocorre quando um recurso (variável, estrutura, arquivo, conexão) não é inicializado ou recebe um valor inicial incorreto antes do uso. O código acessa ou manipula o recurso em um estado indefinido, levando a comportamentos imprevisíveis, corrupção de dados ou falhas de segurança.

Example

Um buffer alocado dinamicamente que nunca recebe um valor inicial é processado como se contivesse dados válidos; ou um ponteiro não é definido como NULL antes de ser verificado, causando derreferenciação de endereço inválido. Em contexto de credenciais: uma struct de sessão alocada mas não zerada retém dados de uma sessão anterior.

How to mitigate

Sempre inicializar recursos explicitamente no ponto de declaração ou alocação (ex: `int var = 0;`, `memset(struct, 0, sizeof(struct))`, construtores em C++). Use linters e análise estática para detectar variáveis não inicializadas antes do uso.

CVE-2023-4503MEDIUMEap-galleon: custom provisioning creates unsecured http-invokerEPSS 0.7%CVE-2022-22164MEDIUMJunos OS Evolved: Telnet service may be enabled when it is expected to be disabled.EPSS 0.7%CVE-2023-37479MEDIUMImproper sanitization of MXCSR and RFLAGS in OpenEnclaveEPSS 0.7%CVE-2022-22186HIGHJunos OS: EX4650 Series: Certain traffic received by the Junos OS device on the management interface may be forwarded to egress interfaces instead of discardedEPSS 0.6%CVE-2019-1761MEDIUMCisco IOS and IOS XE Software Hot Standby Router Protocol Information Leak VulnerabilityEPSS 0.6%CVE-2023-23555HIGHBIG-IP Virtual Edition vulnerabilityEPSS 0.6%CVE-2022-46487HIGHImproper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for IntelEPSS 0.6%CVE-2023-1048MEDIUMTechPowerUp Ryzen DRAM Calculator WinRing0x64.sys initializationEPSS 0.6%CVE-2023-22466MEDIUMTokio's reject_remote_clients configuration may get dropped when creating a Windows named pipeEPSS 0.6%CVE-2025-14955MEDIUMOpen5GS PFCP handler.c ogs_pfcp_handle_create_pdr initializationEPSS 0.6%CVE-2021-33635CRITICALPull malicious images may cause process to be hijackedEPSS 0.6%CVE-2026-64775CRITICALA memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15EPSS 0.6%CVE-2022-3259HIGHOpenshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.EPSS 0.5%CVE-2023-3242HIGHImproper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated netwEPSS 0.5%CVE-2022-39384MEDIUMOpenZeppelin Contracts initializer reentrancy may lead to double initializationEPSS 0.5%CVE-2018-10901HIGHA flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, butEPSS 0.5%CVE-2025-66363HIGHAn issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. There was no check for memory initialization within DL NAS TransportEPSS 0.5%CVE-2024-36455CRITICALSymantec Privileged Access Manager Remote Command Execution vulnerabilityEPSS 0.5%CVE-2022-48352HIGHSome smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic.EPSS 0.5%CVE-2026-54409HIGHA malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UnEPSS 0.4%