Fallos del tipo CWE-226

37 resultados

Informação sensível não removida antes de reutilizar recurso

Ocorre quando um recurso (memória, arquivo, buffer) que continha dados sensíveis é reutilizado sem limpeza prévia. Um atacante pode recuperar dados anteriores (senhas, tokens, dados pessoais) lendo o recurso antes de ser sobrescrito. O risco é alto em ambientes compartilhados ou quando o recurso é alocado a outro usuário/processo.

Ejemplo

Um servidor web reutiliza um buffer para processar requisições de múltiplos clientes. Se não limpar o buffer entre requisições, o cliente B pode ler resquícios do token JWT ou senha do cliente A que estava no mesmo espaço de memória.

Cómo mitigar

Sempre zerar ou sobrescrever dados sensíveis (memória, strings) imediatamente após uso, antes de liberar o recurso. Use funções explícitas de limpeza (como `memset_s()` em C, ou `SecureString` em .NET) e evite confiar em garbage collection para dados críticos.

CVE-2025-13108MEDIUMFixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and WindowsEPSS 0.2%CVE-2019-25563MEDIUMPCHelpWareV2 1.0.0.5 Denial of Service via SC CreationEPSS 0.2%CVE-2019-25571MEDIUMMediaMonkey 4.1.23 Denial of Service via Malformed URLEPSS 0.2%CVE-2023-41138HIGHThe AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user pEPSS 0.2%CVE-2019-25645MEDIUMWinAVI iPod 3GP MP4 PSP Converter 4.4.2 Denial of ServiceEPSS 0.2%CVE-2025-0647HIGHIn certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to thEPSS 0.2%CVE-2019-25553MEDIUMCEWE PHOTO IMPORTER 6.4.3 Denial of Service via Malformed ImageEPSS 0.2%CVE-2026-13585HIGHAllocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System ContEPSS 0.2%CVE-2026-48984MEDIUMpam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heapEPSS 0.1%CVE-2025-33196MEDIUMNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploiEPSS 0.1%CVE-2025-33200LOWNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploiEPSS 0.1%CVE-2025-33198LOWNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploiEPSS 0.1%CVE-2025-20622LOWSensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023 EPSS 0.1%CVE-2019-25617MEDIUMEase Audio Converter 5.30 Denial of Service via Audio CutterEPSS 0.1%CVE-2025-14858MEDIUMSemtech LR11xx Encrypted Firmware DisclosureEPSS 0.1%CVE-2025-48066MEDIUMwire-webapp has no database deletion on client logoutEPSS 0.1%CVE-2026-18023MEDIUMSensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive informatioEPSS 0.1%