Fallos del tipo CWE-459

114 resultados

Limpeza Incompleta de Recursos

Ocorre quando uma aplicação não libera completamente recursos (memória, arquivos, conexões, sessões) ao encerrar um processo ou função, deixando dados sensíveis ou ocupação residual no sistema. Isso pode levar a vazamento de memória, exposição de informações confidenciais ou degradação de desempenho.

Ejemplo

Uma função abre uma conexão com banco de dados dentro de um bloco try-catch, mas se uma exceção é lançada, a conexão nunca é fechada. Ou um arquivo temporário contendo credenciais é deletado, mas o buffer em memória não é zerado, permitindo recuperação forense.

Cómo mitigar

Use padrões como try-with-resources (Java), context managers (Python), ou defer (Go) para garantir limpeza automática. Implemente finally blocks explícitos, zero-out buffers com dados sensíveis e valide que todos os recursos foram liberados em testes de integração.

CVE-2026-19019MEDIUMpoco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanupEPSS 0.3%CVE-2026-67442LOWFUXA Business Logic Flaw: Role Deletion Without User Assignment CleanupEPSS 0.3%CVE-2022-0171—A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to cEPSS 0.3%CVE-2026-79265MEDIUMIncomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procesEPSS 0.3%CVE-2024-6300LOWIncomplete Cleanup in ConduitEPSS 0.3%CVE-2024-21617MEDIUMJunos OS: BGP flap on NSR-enabled devices causes memory leakEPSS 0.3%CVE-2026-82236LOWFile Browser 2.63.6 through 2.63.23 Share Link Exposure via File DeletionEPSS 0.3%CVE-2026-5038MEDIUMmulter vulnerable to Denial of Service via incomplete cleanup of aborted uploadsEPSS 0.3%CVE-2026-19474HIGH@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted uploadEPSS 0.3%CVE-2026-68809MEDIUMPowerpoint Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-60730HIGHPerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme functionEPSS 0.3%CVE-2026-78947MEDIUMIncomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass webEPSS 0.3%CVE-2024-1048LOWGrub2: grub2-set-bootflag can be abused by local (pseudo-)usersEPSS 0.3%CVE-2026-78903LOWIncomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proceEPSS 0.3%CVE-2022-27639MEDIUMIncomplete cleanup in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentialEPSS 0.3%CVE-2026-91730LOWIncomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer procesEPSS 0.2%CVE-2025-55910MEDIUMCMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.EPSS 0.2%CVE-2023-45846MEDIUMIncomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of EPSS 0.2%CVE-2022-3238HIGHA double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allowEPSS 0.2%CVE-2022-43477LOWIncomplete cleanup for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local accEPSS 0.2%