Fallos del tipo CWE-664

64 resultados

Controle inadequado de recurso durante seu ciclo de vida

Fraqueza genérica onde o software falha em gerenciar corretamente um recurso (memória, arquivo, conexão, etc.) desde sua alocação até sua liberação. Sem aquisição, uso ou liberação adequados, o recurso pode vazar, ser acessado após ser destruído, ou ficar em estado inconsistente, abrindo brechas de segurança.

Ejemplo

Um aplicativo abre uma conexão com banco de dados dentro de um bloco try, mas não fecha a conexão em um finally ou try-with-resources. Se uma exceção for lançada, a conexão permanece aberta, esgotando o pool de conexões e causando negação de serviço; ou um ponteiro é desalocado mas o código continua tentando acessá-lo, gerando leitura/escrita em memória inválida.

Cómo mitigar

Use padrões de gerenciamento automático: try-with-resources (Java), context managers (Python), RAII (C++), ou garbage collection. Garanta aquisição em um ponto e liberação em outro bem definido. Para recursos críticos, implemente testes que validem ciclos de vida completos e ferramentas estáticas de análise que detectem leaks e acessos inválidos.

CVE-2022-27518CRITICALUnauthenticated remote arbitrary code executionEPSS 6.9%KEVCVE-2022-2048HIGHIn Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up noEPSS 2.6%CVE-2022-2191HIGHIn Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByEPSS 2.2%CVE-2026-43503HIGHnet: skbuff: propagate shared-frag marker through frag-transfer helpersEPSS 2.0%CVE-2020-3175HIGHCisco MDS 9000 Series Multilayer Switches Denial of Service VulnerabilityEPSS 2.0%CVE-2019-16779MEDIUMIn RubyGem excon, interrupted Persistent Connections May Leak Response DataEPSS 1.7%CVE-2024-45383MEDIUMA mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.36EPSS 1.5%CVE-2022-31153MEDIUMOpenZeppelin Contracts for Cairo account cannot process transactions on GoerliEPSS 1.5%CVE-2022-20748MEDIUMCisco Firepower Threat Defense Software Local Malware Analysis Denial of Service VulnerabilityEPSS 1.3%CVE-2022-20856HIGHCisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Mobility Denial of Service VulnerabilityEPSS 1.3%CVE-2021-1592MEDIUMCisco UCS Manager Software SSH Sessions Denial of Service VulnerabilityEPSS 1.0%CVE-2022-27512—Temporary disruption of the ADM license serviceEPSS 1.0%CVE-2022-46144HIGHA vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V2.3), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) EPSS 0.9%CVE-2022-1385LOWInvitation Email is resent as a Reminder after invalidating pending email invitesEPSS 0.8%CVE-2026-72041CRITICALespintcp: use sk_msg_free_partial to fix partial sendEPSS 0.7%CVE-2023-44288HIGH Dell PowerScale OneFS, 8.2.2.x through 9.6.0.x, contains an improper control of a resource through its lifetime vulnerability. An unauthentEPSS 0.7%CVE-2024-41169HIGHApache Zeppelin: raft directory listing and file readEPSS 0.7%CVE-2025-34226HIGHOpenPLC Runtime v3 Persistent DoSEPSS 0.7%CVE-2022-32846HIGHA logic issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to accEPSS 0.6%CVE-2023-25942MEDIUM Dell PowerScale OneFS versions 8.2.x-9.4.x contain an uncontrolled resource consumption vulnerability. A malicious network user with low prEPSS 0.6%