Fallos del tipo CWE-459

114 resultados

Limpeza Incompleta de Recursos

Ocorre quando uma aplicação não libera completamente recursos (memória, arquivos, conexões, sessões) ao encerrar um processo ou função, deixando dados sensíveis ou ocupação residual no sistema. Isso pode levar a vazamento de memória, exposição de informações confidenciais ou degradação de desempenho.

Ejemplo

Uma função abre uma conexão com banco de dados dentro de um bloco try-catch, mas se uma exceção é lançada, a conexão nunca é fechada. Ou um arquivo temporário contendo credenciais é deletado, mas o buffer em memória não é zerado, permitindo recuperação forense.

Cómo mitigar

Use padrões como try-with-resources (Java), context managers (Python), ou defer (Go) para garantir limpeza automática. Implemente finally blocks explícitos, zero-out buffers com dados sensíveis e valide que todos os recursos foram liberados em testes de integração.

CVE-2023-31356MEDIUMIncomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting inEPSS 0.2%CVE-2023-29184LOWAn incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.EPSS 0.2%CVE-2022-26074MEDIUMIncomplete cleanup in a firmware subsystem for Intel(R) SPS before versions SPS_E3_04.08.04.330.0 and SPS_E3_04.01.04.530.0 may allow a privEPSS 0.2%CVE-2022-40974LOWIncomplete cleanup in the Intel(R) IPP Cryptography software before version 2021.6 may allow a privileged user to potentially enable informaEPSS 0.2%CVE-2026-67334MEDIUMbetter-auth Stale Sessions Persist After User DeletionEPSS 0.2%CVE-2024-53869MEDIUMNVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A successful exploit of tEPSS 0.2%CVE-2025-20293MEDIUMA vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) coulEPSS 0.2%CVE-2022-46298LOWIncomplete cleanup for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access.EPSS 0.2%CVE-2026-53867MEDIUMCapgo < 12.128.2 - Orphaned File Retention via Profile Image ReplacementEPSS 0.2%CVE-2026-78600LOWIncomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential RetentionEPSS 0.2%CVE-2022-25664MEDIUMInformation disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectiviEPSS 0.2%CVE-2026-7639HIGHGPU DDK - Page UAF read in PMMETA_PROTECT heap memoryEPSS 0.2%CVE-2026-82237LOWfilebrowser through 2.63.23 Stale Share Link via File RenameEPSS 0.2%CVE-2026-9693LOWMattermost thread memberships persist after team removal, exposing private channel thread metadata on re-inviteEPSS 0.2%CVE-2024-36353MEDIUMInsufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potentialEPSS 0.2%CVE-2025-43711HIGHTunnelblick 3.5beta06 before 7.0, when incompletely uninstalled, allows attackers to execute arbitrary code as root (upon the next boot) by EPSS 0.2%CVE-2025-0032HIGHImproper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcoEPSS 0.2%CVE-2026-63545LOWSharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed latEPSS 0.2%CVE-2024-53881MEDIUMNVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which EPSS 0.1%CVE-2024-21977LOWIncomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDRAND instruction, potEPSS 0.1%