Weaknesses of type CWE-665

166 results

Inicialização incorreta ou ausente de recurso

Ocorre quando um recurso (variável, estrutura, arquivo, conexão) não é inicializado ou recebe um valor inicial incorreto antes do uso. O código acessa ou manipula o recurso em um estado indefinido, levando a comportamentos imprevisíveis, corrupção de dados ou falhas de segurança.

Example

Um buffer alocado dinamicamente que nunca recebe um valor inicial é processado como se contivesse dados válidos; ou um ponteiro não é definido como NULL antes de ser verificado, causando derreferenciação de endereço inválido. Em contexto de credenciais: uma struct de sessão alocada mas não zerada retém dados de uma sessão anterior.

How to mitigate

Sempre inicializar recursos explicitamente no ponto de declaração ou alocação (ex: `int var = 0;`, `memset(struct, 0, sizeof(struct))`, construtores em C++). Use linters e análise estática para detectar variáveis não inicializadas antes do uso.

CVE-2026-54279LOWAIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar PersistenceEPSS 0.5%CVE-2024-36455CRITICALSymantec Privileged Access Manager Remote Command Execution vulnerabilityEPSS 0.5%CVE-2022-48352HIGHSome smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic.EPSS 0.5%CVE-2026-64035CRITICALigc: set tx buffer type for SMD framesEPSS 0.4%CVE-2026-87616HIGHImproper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renEPSS 0.4%CVE-2024-54129CRITICALImproper Initialization of `imc` Scheme Leading to `SIGABRT` in ION-DTN BPv7EPSS 0.4%CVE-2026-54409HIGHA malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UnEPSS 0.4%CVE-2026-64368HIGHmm/slab: do not limit zeroing to orig_size when only red zoning is enabledEPSS 0.4%CVE-2026-26958LOWfilippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identityEPSS 0.4%CVE-2026-57229MEDIUMSuricata smtp/mime: incomplete state reset allows detection bypassEPSS 0.4%CVE-2023-28720MEDIUMImproper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenEPSS 0.4%CVE-2023-1047MEDIUMTechPowerUp RealTemp WinRing0x64.sys initializationEPSS 0.4%CVE-2023-35061LOWImproper initialization for the Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthentEPSS 0.4%CVE-2020-14347MEDIUMA flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases whEPSS 0.4%CVE-2021-20317—A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timeEPSS 0.4%CVE-2018-1118LOWLinux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating syEPSS 0.4%CVE-2023-27322HIGHParallels Desktop Service Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-27324HIGHParallels Desktop Updater Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-55118HIGHBMC Control-M/Agent memory corruption in SSL/TLS communicationEPSS 0.4%CVE-2023-40261MEDIUMDiebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR17, 4.0.0 SR07, 4.1.0 SR04, 4.2.0 SR04, and 4.3.0 SR02 fails to validate file atEPSS 0.4%