Fallos del tipo CWE-459

158 resultados

Limpeza Incompleta de Recursos

Ocorre quando uma aplicação não libera completamente recursos (memória, arquivos, conexões, sessões) ao encerrar um processo ou função, deixando dados sensíveis ou ocupação residual no sistema. Isso pode levar a vazamento de memória, exposição de informações confidenciais ou degradação de desempenho.

Ejemplo

Uma função abre uma conexão com banco de dados dentro de um bloco try-catch, mas se uma exceção é lançada, a conexão nunca é fechada. Ou um arquivo temporário contendo credenciais é deletado, mas o buffer em memória não é zerado, permitindo recuperação forense.

Cómo mitigar

Use padrões como try-with-resources (Java), context managers (Python), ou defer (Go) para garantir limpeza automática. Implemente finally blocks explícitos, zero-out buffers com dados sensíveis e valide que todos os recursos foram liberados em testes de integração.

CVE-2026-95303MEDIUMIncomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass syEPSS 0.3%CVE-2026-9693LOWMattermost thread memberships persist after team removal, exposing private channel thread metadata on re-inviteEPSS 0.3%CVE-2022-27639MEDIUMIncomplete cleanup in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentialEPSS 0.3%CVE-2024-1048LOWGrub2: grub2-set-bootflag can be abused by local (pseudo-)usersEPSS 0.3%CVE-2026-116132HIGHHTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on diskEPSS 0.2%CVE-2026-91730LOWIncomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer procesEPSS 0.2%CVE-2022-3238HIGHA double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allowEPSS 0.2%CVE-2025-55910MEDIUMCMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.EPSS 0.2%CVE-2026-106394MEDIUMIncomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-oriEPSS 0.2%CVE-2023-29184LOWAn incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.EPSS 0.2%CVE-2023-45846MEDIUMIncomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of EPSS 0.2%CVE-2026-106366MEDIUMIncomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policyEPSS 0.2%CVE-2022-43477LOWIncomplete cleanup for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local accEPSS 0.2%CVE-2026-75944MEDIUMA race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. UserEPSS 0.2%CVE-2026-63545LOWSharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed latEPSS 0.2%CVE-2026-85033MEDIUMBluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peerEPSS 0.2%CVE-2023-31356MEDIUMIncomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting inEPSS 0.2%CVE-2026-82237LOWfilebrowser through 2.63.23 Stale Share Link via File RenameEPSS 0.2%CVE-2025-20293MEDIUMA vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) coulEPSS 0.2%CVE-2022-26074MEDIUMIncomplete cleanup in a firmware subsystem for Intel(R) SPS before versions SPS_E3_04.08.04.330.0 and SPS_E3_04.01.04.530.0 may allow a privEPSS 0.2%