Fallos del tipo CWE-399

160 resultados

Erros de Gerenciamento de Recursos

Fraqueza genérica que abrange falhas na alocação, uso e liberação de recursos do sistema (memória, conexões, arquivos, sockets). O código não rastreia ou libera corretamente esses recursos, causando vazamentos, esgotamento ou acesso inválido que leva a crash, negação de serviço ou exploração.

Ejemplo

Um servidor web abre uma conexão com banco de dados para cada requisição, mas não a fecha se uma exceção ocorre no meio do processamento. Após centenas de requisições, todas as conexões disponíveis estão em uso e novas requisições falham. Um atacante pode disparar requisições malformadas para manter conexões abertas indefinidamente.

Cómo mitigar

Use padrões de limpeza automática (try-finally, context managers em Python, using em C#) para garantir liberação de recursos mesmo em erro. Implemente timeouts, limites de recursos por processo e monitoramento de vazamento. Audite rotineiramente código que abre/fecha conexões, arquivos ou aloca memória.

CVE-2017-3826—A vulnerability in the Stream Control Transmission Protocol (SCTP) decoder of the Cisco NetFlow Generation Appliance (NGA) with software befEPSS 1.7%CVE-2017-6628—A vulnerability in SMART-SSL Accelerator functionality for Cisco Wide Area Application Services (WAAS) 6.2.1, 6.2.1a, and 6.2.3a could allowEPSS 1.7%CVE-2017-6615—A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE 3.16 could allow an authenticated, remote attackeEPSS 1.7%CVE-2014-1745HIGHUse-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cEPSS 1.7%CVE-2022-20767HIGHCisco Firepower Threat Defense Software DNS Enforcement Denial of Service VulnerabilityEPSS 1.7%CVE-2018-0290—A vulnerability in the TCP stack of Cisco SocialMiner could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conEPSS 1.7%CVE-2017-12287—A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video CommunicEPSS 1.6%CVE-2017-12211—A vulnerability in the IPv6 Simple Network Management Protocol (SNMP) code of Cisco IOS and Cisco IOS XE Software could allow an authenticatEPSS 1.6%CVE-2020-3168HIGHCisco Nexus 1000V Switch for VMware vSphere Secure Login Enhancements Denial of Service VulnerabilityEPSS 1.6%CVE-2017-12318—A vulnerability in the TCP state machine of Cisco RF Gateway 1 devices could allow an unauthenticated, remote attacker to prevent an affecteEPSS 1.6%CVE-2018-0137—A vulnerability in the TCP throttling process of Cisco Prime Network could allow an unauthenticated, remote attacker to cause a denial of seEPSS 1.6%CVE-2017-12245—A vulnerability in SSL traffic decryption for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker EPSS 1.6%CVE-2018-0397—A vulnerability in Cisco AMP for Endpoints Mac Connector Software installed on Apple macOS 10.12 could allow an unauthenticated, remote attaEPSS 1.5%CVE-2019-16021HIGHCisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesEPSS 1.5%CVE-2018-4851—A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to theEPSS 1.5%CVE-2022-20756HIGHCisco Identity Services Engine RADIUS Service Denial of Service VulnerabilityEPSS 1.5%CVE-2021-1377MEDIUMCisco IOS and IOS XE Software ARP Resource Management Exhaustion Denial of Service VulnerabilityEPSS 1.4%CVE-2017-12256—A vulnerability in the Akamai Connect feature of Cisco Wide Area Application Services (WAAS) Appliances could allow an unauthenticated, remoEPSS 1.4%CVE-2018-15391—Cisco Remote PHY IPv4 Fragment Denial of Service VulnerabilityEPSS 1.4%CVE-2019-15258MEDIUMCisco SPA100 Series Analog Telephone Adapters Web Management Interface Denial of Service VulnerabilityEPSS 1.4%