Weaknesses of type CWE-665

166 results

Inicialização incorreta ou ausente de recurso

Ocorre quando um recurso (variável, estrutura, arquivo, conexão) não é inicializado ou recebe um valor inicial incorreto antes do uso. O código acessa ou manipula o recurso em um estado indefinido, levando a comportamentos imprevisíveis, corrupção de dados ou falhas de segurança.

Example

Um buffer alocado dinamicamente que nunca recebe um valor inicial é processado como se contivesse dados válidos; ou um ponteiro não é definido como NULL antes de ser verificado, causando derreferenciação de endereço inválido. Em contexto de credenciais: uma struct de sessão alocada mas não zerada retém dados de uma sessão anterior.

How to mitigate

Sempre inicializar recursos explicitamente no ponto de declaração ou alocação (ex: `int var = 0;`, `memset(struct, 0, sizeof(struct))`, construtores em C++). Use linters e análise estática para detectar variáveis não inicializadas antes do uso.

CVE-2023-27325HIGHParallels Desktop Updater Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-26084LOWThe armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected dataEPSS 0.4%CVE-2026-94370MEDIUMMemory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUsEPSS 0.3%CVE-2026-78940MEDIUMImproper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftEPSS 0.3%CVE-2021-0145MEDIUMImproper initialization of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information diEPSS 0.3%CVE-2025-5702MEDIUMThe strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to EPSS 0.3%CVE-2026-103394LOWSession Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.EPSS 0.3%CVE-2025-71128HIGHerspan: Initialize options_len before referencing options.EPSS 0.3%CVE-2023-27115—WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.EPSS 0.3%CVE-2021-4218—A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This fEPSS 0.3%CVE-2021-0125MEDIUMImproper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privileEPSS 0.3%CVE-2023-25010HIGHA malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code exeEPSS 0.3%CVE-2023-20591MEDIUMImproper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker toEPSS 0.3%CVE-2021-0119MEDIUMImproper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privileEPSS 0.3%CVE-2022-2472HIGHImproper Initialization vulnerability in local server authentication logicEPSS 0.3%CVE-2022-32579MEDIUMImproper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially eEPSS 0.3%CVE-2024-45289HIGHUnbounded allocation in ctl(4) CAM Target LayerEPSS 0.3%CVE-2021-23223HIGHImproper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enablEPSS 0.3%CVE-2025-5745MEDIUMThe strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 toEPSS 0.3%CVE-2025-46553LOW@misskey-dev/summaly Redirect Filter BypassEPSS 0.3%