Fallos del tipo CWE-399

160 resultados

Erros de Gerenciamento de Recursos

Fraqueza genérica que abrange falhas na alocação, uso e liberação de recursos do sistema (memória, conexões, arquivos, sockets). O código não rastreia ou libera corretamente esses recursos, causando vazamentos, esgotamento ou acesso inválido que leva a crash, negação de serviço ou exploração.

Ejemplo

Um servidor web abre uma conexão com banco de dados para cada requisição, mas não a fecha se uma exceção ocorre no meio do processamento. Após centenas de requisições, todas as conexões disponíveis estão em uso e novas requisições falham. Um atacante pode disparar requisições malformadas para manter conexões abertas indefinidamente.

Cómo mitigar

Use padrões de limpeza automática (try-finally, context managers em Python, using em C#) para garantir liberação de recursos mesmo em erro. Implemente timeouts, limites de recursos por processo e monitoramento de vazamento. Audite rotineiramente código que abre/fecha conexões, arquivos ou aloca memória.

CVE-2020-3351HIGHCisco SD-WAN Solution Software Denial of Service VulnerabilityEPSS 1.4%CVE-2022-20715HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Access SSL VPN Denial of Service VulnerabilityEPSS 1.3%CVE-2021-1611HIGHCisco IOS XE Software for Catalyst 9800 Series Wireless Controllers EoGRE Denial of Service VulnerabilityEPSS 1.3%CVE-2021-1624HIGHCisco IOS XE Software Rate Limiting Network Address Translation Denial of Service VulnerabilityEPSS 1.3%CVE-2019-16020HIGHCisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesEPSS 1.3%CVE-2019-16022HIGHCisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesEPSS 1.3%CVE-2019-16023HIGHCisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesEPSS 1.3%CVE-2019-16019HIGHCisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesEPSS 1.3%CVE-2018-0272—A vulnerability in the Secure Sockets Layer (SSL) Engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker EPSS 1.3%CVE-2018-0380—Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format (ARF) and Webex Recording Format (WEPSS 1.3%CVE-2021-1394MEDIUMCisco IOS XE Software for Network Convergence System 520 Routers Denial of Service VulnerabilityEPSS 1.3%CVE-2020-3303MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software IKEv1 Denial of Service VulnerabilityEPSS 1.2%CVE-2022-20758MEDIUMCisco IOS XR Software Border Gateway Protocol Ethernet VPN Denial of Service VulnerabilityEPSS 1.2%CVE-2019-1587MEDIUMCisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Filter Query Information Disclosure VulnerabilityEPSS 1.2%CVE-2021-40122MEDIUMCisco Meeting Server Call Bridge Denial of Service VulnerabilityEPSS 1.2%CVE-2022-20847HIGHCisco IOS XE Wireless Controller Software for the Catalyst 9000 Family DHCP Processing Denial of Service VulnerabilityEPSS 1.2%CVE-2018-15390—Cisco Firepower Threat Defense Software FTP Inspection Denial of Service VulnerabilityEPSS 1.1%CVE-2021-1623HIGHCisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers Simple Network Management Protocol Denial of Service VulnerabilityEPSS 1.1%CVE-2019-12665MEDIUMCisco IOS and IOS XE Software HTTP Client Information Disclosure VulnerabilityEPSS 1.1%CVE-2018-15404—Cisco Integrated Management Controller Supervisor and Cisco UCS Director System Resources Denial of Service VulnerabilityEPSS 1.1%