Fallos del tipo CWE-664

43 resultados

Controle inadequado de recurso durante seu ciclo de vida

Fraqueza genérica onde o software falha em gerenciar corretamente um recurso (memória, arquivo, conexão, etc.) desde sua alocação até sua liberação. Sem aquisição, uso ou liberação adequados, o recurso pode vazar, ser acessado após ser destruído, ou ficar em estado inconsistente, abrindo brechas de segurança.

Ejemplo

Um aplicativo abre uma conexão com banco de dados dentro de um bloco try, mas não fecha a conexão em um finally ou try-with-resources. Se uma exceção for lançada, a conexão permanece aberta, esgotando o pool de conexões e causando negação de serviço; ou um ponteiro é desalocado mas o código continua tentando acessá-lo, gerando leitura/escrita em memória inválida.

Cómo mitigar

Use padrões de gerenciamento automático: try-with-resources (Java), context managers (Python), RAII (C++), ou garbage collection. Garanta aquisição em um ponto e liberação em outro bem definido. Para recursos críticos, implemente testes que validem ciclos de vida completos e ferramentas estáticas de análise que detectem leaks e acessos inválidos.

CVE-2022-27518CRITICALUnauthenticated remote arbitrary code executionEPSS 6.9%KEVCVE-2022-2048HIGHIn Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up noEPSS 2.3%CVE-2022-2191HIGHIn Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByEPSS 2.1%CVE-2020-3175HIGHCisco MDS 9000 Series Multilayer Switches Denial of Service VulnerabilityEPSS 2.0%CVE-2024-45383MEDIUMA mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.36EPSS 1.5%CVE-2019-16779MEDIUMIn RubyGem excon, interrupted Persistent Connections May Leak Response DataEPSS 1.4%CVE-2022-31153MEDIUMOpenZeppelin Contracts for Cairo account cannot process transactions on GoerliEPSS 1.4%CVE-2022-20748MEDIUMCisco Firepower Threat Defense Software Local Malware Analysis Denial of Service VulnerabilityEPSS 1.2%CVE-2022-20856HIGHCisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Mobility Denial of Service VulnerabilityEPSS 1.2%CVE-2021-1592MEDIUMCisco UCS Manager Software SSH Sessions Denial of Service VulnerabilityEPSS 1.0%CVE-2022-27512—Temporary disruption of the ADM license serviceEPSS 0.9%CVE-2022-46144HIGHA vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V2.3), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) EPSS 0.9%CVE-2022-1385LOWInvitation Email is resent as a Reminder after invalidating pending email invitesEPSS 0.8%CVE-2023-44288HIGH Dell PowerScale OneFS, 8.2.2.x through 9.6.0.x, contains an improper control of a resource through its lifetime vulnerability. An unauthentEPSS 0.7%CVE-2025-34226HIGHOpenPLC Runtime v3 Persistent DoSEPSS 0.6%CVE-2022-32846HIGHA logic issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to accEPSS 0.6%CVE-2023-25942MEDIUM Dell PowerScale OneFS versions 8.2.x-9.4.x contain an uncontrolled resource consumption vulnerability. A malicious network user with low prEPSS 0.6%CVE-2024-41169HIGHApache Zeppelin: raft directory listing and file readEPSS 0.6%CVE-2022-28287MEDIUMIn unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability afEPSS 0.5%CVE-2026-8517HIGHObject lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage EPSS 0.5%