Fallos del tipo CWE-404

695 resultados

Liberação ou encerramento inadequado de recursos

Quando o software não libera corretamente recursos (conexões de banco, arquivo aberto, memória alocada, socket de rede) após o uso. O programa continua consumindo esses recursos até ficar sem espaço ou conexões disponíveis, causando falhas, lentidão ou negação de serviço.

Ejemplo

Um servidor web abre uma conexão com banco de dados para cada requisição, mas esquece de fechar a conexão quando termina. Após centenas de requisições, todas as conexões disponíveis estão esgotadas e novas requisições falham.

Cómo mitigar

Use padrões como try-with-resources (Java), context managers (Python), ou equivalentes na sua linguagem para garantir liberação automática. Implemente timeouts e monitore uso de recursos em produção para detectar vazamentos cedo.

CVE-2023-23151MEDIUMbloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file deletion vulnerability via the component /include/inc_content_media.php.EPSS 1.0%CVE-2022-3299MEDIUMOpen5GS AMF client.c denial of serviceEPSS 1.0%CVE-2022-3957MEDIUMGPAC SVG Parser svg_attributes.c svg_parse_preserveaspectratio memory leakEPSS 1.0%CVE-2021-4247MEDIUMOWASP NodeGoat Query Parameter research.js denial of serviceEPSS 1.0%CVE-2023-4463MEDIUMPoly CCX 400/CCX 600/Trio 8800/Trio C60 HTTP Header denial of serviceEPSS 1.0%CVE-2022-3526MEDIUMLinux Kernel skb macvlan.c macvlan_handle_frame memory leakEPSS 1.0%CVE-2023-3760MEDIUMIntergard SGS Change Password denial of serviceEPSS 1.0%CVE-2023-0029MEDIUMMultilaser RE708 Telnet Service denial of serviceEPSS 1.0%CVE-2024-0736MEDIUMEFS Easy File Sharing FTP Login denial of serviceEPSS 1.0%CVE-2023-5259LOWForU CMS cms_admin.php denial of serviceEPSS 1.0%CVE-2024-0695MEDIUMEFS Easy Chat Server HTTP GET Request denial of serviceEPSS 1.0%CVE-2025-11550HIGHTenda W12 HTTP Request modules wifiScheduledSet null pointer dereferenceEPSS 1.0%CVE-2022-23010—On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when EPSS 1.0%CVE-2025-7797MEDIUMGPAC dash_client.c gf_dash_download_init_segment null pointer dereferenceEPSS 1.0%CVE-2015-10085LOWGoPistolet MTA denial of serviceEPSS 0.9%CVE-2021-21003MEDIUMDenial of Service Vulnerability in Phoenix Contact FL SWITCH SMCS series productsEPSS 0.9%CVE-2020-27283MEDIUMAn attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak arbitrary memory locatiEPSS 0.9%CVE-2023-0936MEDIUMTP-Link Archer C50 Web Management Interface denial of serviceEPSS 0.9%CVE-2024-21052MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and priEPSS 0.9%CVE-2025-15528MEDIUMOpen5GS GTPv2 Bearer Response denial of serviceEPSS 0.9%