Fallos del tipo CWE-665

166 resultados

Inicialização incorreta ou ausente de recursos

Ocorre quando um recurso (variável, buffer, conexão, arquivo) não é inicializado ou é inicializado de forma incompleta antes do uso, deixando-o em estado indeterminado. Isso pode levar a comportamentos imprevisíveis, vazamento de dados sensíveis ou crashes, pois o código tenta usar valores aleatórios ou valores de memória anterior.

Ejemplo

Um desenvolvedor declara um buffer para armazenar credenciais, mas esquece de zerar sua memória antes de preenchê-lo; se o código ler dessa memória antes de atribuir um valor válido, pode expor dados de sessões anteriores. Ou uma variável booleana que controla acesso é usada sem ser definida, assumindo um valor aleatório de memória.

Cómo mitigar

Sempre inicialize explicitamente recursos no ponto de declaração ou antes do primeiro uso: atribua valores padrão seguros, use construtores ou funções de setup específicas. Ferramentas de análise estática (lint, SAST) e testes com sanitizers de memória ajudam a detectar usos sem inicialização.

CVE-2023-27325HIGHParallels Desktop Updater Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-26084LOWThe armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected dataEPSS 0.4%CVE-2026-94370MEDIUMMemory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUsEPSS 0.3%CVE-2026-78940MEDIUMImproper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftEPSS 0.3%CVE-2021-0145MEDIUMImproper initialization of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information diEPSS 0.3%CVE-2025-5702MEDIUMThe strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to EPSS 0.3%CVE-2026-103394LOWSession Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.EPSS 0.3%CVE-2025-71128HIGHerspan: Initialize options_len before referencing options.EPSS 0.3%CVE-2023-27115—WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.EPSS 0.3%CVE-2021-4218—A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This fEPSS 0.3%CVE-2021-0125MEDIUMImproper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privileEPSS 0.3%CVE-2023-25010HIGHA malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code exeEPSS 0.3%CVE-2023-20591MEDIUMImproper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker toEPSS 0.3%CVE-2021-0119MEDIUMImproper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privileEPSS 0.3%CVE-2022-2472HIGHImproper Initialization vulnerability in local server authentication logicEPSS 0.3%CVE-2022-32579MEDIUMImproper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially eEPSS 0.3%CVE-2024-45289HIGHUnbounded allocation in ctl(4) CAM Target LayerEPSS 0.3%CVE-2021-23223HIGHImproper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enablEPSS 0.3%CVE-2025-5745MEDIUMThe strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 toEPSS 0.3%CVE-2025-46553LOW@misskey-dev/summaly Redirect Filter BypassEPSS 0.3%