Fallos del tipo CWE-665

148 resultados

Inicialização incorreta ou ausente de recursos

Ocorre quando um recurso (variável, buffer, conexão, arquivo) não é inicializado ou é inicializado de forma incompleta antes do uso, deixando-o em estado indeterminado. Isso pode levar a comportamentos imprevisíveis, vazamento de dados sensíveis ou crashes, pois o código tenta usar valores aleatórios ou valores de memória anterior.

Ejemplo

Um desenvolvedor declara um buffer para armazenar credenciais, mas esquece de zerar sua memória antes de preenchê-lo; se o código ler dessa memória antes de atribuir um valor válido, pode expor dados de sessões anteriores. Ou uma variável booleana que controla acesso é usada sem ser definida, assumindo um valor aleatório de memória.

Cómo mitigar

Sempre inicialize explicitamente recursos no ponto de declaração ou antes do primeiro uso: atribua valores padrão seguros, use construtores ou funções de setup específicas. Ferramentas de análise estática (lint, SAST) e testes com sanitizers de memória ajudam a detectar usos sem inicialização.

CVE-2022-0847HIGHA flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe EPSS 88.6%KEVCVE-2022-22719—mod_lua Use of uninitialized value of in r:parsebodyEPSS 69.8%CVE-2022-46164CRITICALAccount takeover via prototype vulnerabilityEPSS 49.0%CVE-2020-27950MEDIUMA memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security UEPSS 16.5%KEVCVE-2018-14647MEDIUMPython's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial oEPSS 11.3%CVE-2013-1675MEDIUMMozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properEPSS 6.7%KEVCVE-2018-10915HIGHA vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between coEPSS 5.2%CVE-2023-1719HIGHBitrix24 Insecure Global Variable ExtractionEPSS 5.0%CVE-2022-21724HIGHUnchecked Class Instantiation when providing Plugin ClassesEPSS 3.0%CVE-2019-8259—UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be EPSS 3.0%CVE-2022-36364—Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vectorEPSS 3.0%CVE-2019-8277—UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can beEPSS 3.0%CVE-2019-15681—LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker tEPSS 2.9%CVE-2018-14282—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 2.8%CVE-2018-10484—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.7%CVE-2018-1175—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User iEPSS 2.7%CVE-2018-1174—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User iEPSS 2.6%CVE-2019-1840HIGHCisco Prime Network Registrar Denial of Service VulnerabilityEPSS 2.4%CVE-2016-9594MEDIUMcurl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. EPSS 2.3%CVE-2020-10725HIGHA flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend appliEPSS 2.2%