Fallos del tipo CWE-459

158 resultados

Limpeza Incompleta de Recursos

Ocorre quando uma aplicação não libera completamente recursos (memória, arquivos, conexões, sessões) ao encerrar um processo ou função, deixando dados sensíveis ou ocupação residual no sistema. Isso pode levar a vazamento de memória, exposição de informações confidenciais ou degradação de desempenho.

Ejemplo

Uma função abre uma conexão com banco de dados dentro de um bloco try-catch, mas se uma exceção é lançada, a conexão nunca é fechada. Ou um arquivo temporário contendo credenciais é deletado, mas o buffer em memória não é zerado, permitindo recuperação forense.

Cómo mitigar

Use padrões como try-with-resources (Java), context managers (Python), ou defer (Go) para garantir limpeza automática. Implemente finally blocks explícitos, zero-out buffers com dados sensíveis e valide que todos os recursos foram liberados em testes de integração.

CVE-2026-121096—Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium secuEPSS 0.2%CVE-2022-45455MEDIUMLocal privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office EPSS 0.1%CVE-2026-28196LOWIn JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on diskEPSS 0.1%CVE-2026-121750LOWnvm install --offline installs a cached tarball that previously failed checksum verificationEPSS 0.1%CVE-2026-17525MEDIUMMy Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversionEPSS 0.1%CVE-2026-35361LOWuutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux SystemsEPSS 0.1%CVE-2026-19730MEDIUMPodman: podman: quadlet install --replace non-truncating write retains removed host-access directivesEPSS 0.1%CVE-2026-107914HIGHBackdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archiEPSS 0.1%CVE-2025-29934MEDIUMA bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resultiEPSS 0.1%CVE-2026-6830MEDIUMNesquena Hermes WebUI Environment Variable Credential Leakage via Profile SwitchEPSS 0.1%CVE-2026-0427MEDIUMImproper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to EPSS 0.1%CVE-2024-45445MEDIUMVulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this vulnerability will afEPSS 0.1%CVE-2026-106243MEDIUMIncomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crEPSS 0.1%CVE-2026-107332MEDIUMInsecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio CodeEPSS 0.1%CVE-2026-19740MEDIUMBluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedureEPSS 0.1%CVE-2026-19739MEDIUMBluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection UpdateEPSS 0.1%CVE-2026-110008MEDIUM@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callbackEPSS 0.1%CVE-2023-20518LOWIncomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shellEPSS 0.1%