Fallos del tipo CWE-665

153 resultados

Inicialização incorreta ou ausente de recursos

Ocorre quando um recurso (variável, buffer, conexão, arquivo) não é inicializado ou é inicializado de forma incompleta antes do uso, deixando-o em estado indeterminado. Isso pode levar a comportamentos imprevisíveis, vazamento de dados sensíveis ou crashes, pois o código tenta usar valores aleatórios ou valores de memória anterior.

Ejemplo

Um desenvolvedor declara um buffer para armazenar credenciais, mas esquece de zerar sua memória antes de preenchê-lo; se o código ler dessa memória antes de atribuir um valor válido, pode expor dados de sessões anteriores. Ou uma variável booleana que controla acesso é usada sem ser definida, assumindo um valor aleatório de memória.

Cómo mitigar

Sempre inicialize explicitamente recursos no ponto de declaração ou antes do primeiro uso: atribua valores padrão seguros, use construtores ou funções de setup específicas. Ferramentas de análise estática (lint, SAST) e testes com sanitizers de memória ajudam a detectar usos sem inicialização.

CVE-2025-5702MEDIUMThe strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to EPSS 0.3%CVE-2021-4218—A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This fEPSS 0.3%CVE-2023-20591MEDIUMImproper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker toEPSS 0.3%CVE-2021-0125MEDIUMImproper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privileEPSS 0.3%CVE-2023-25010HIGHA malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code exeEPSS 0.3%CVE-2021-0119MEDIUMImproper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privileEPSS 0.3%CVE-2022-2472HIGHImproper Initialization vulnerability in local server authentication logicEPSS 0.3%CVE-2022-32579MEDIUMImproper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially eEPSS 0.3%CVE-2026-54279LOWAIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar PersistenceEPSS 0.3%CVE-2024-45289HIGHUnbounded allocation in ctl(4) CAM Target LayerEPSS 0.3%CVE-2021-23223HIGHImproper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enablEPSS 0.3%CVE-2021-26326—Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.EPSS 0.3%CVE-2025-5745MEDIUMThe strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 toEPSS 0.3%CVE-2026-62433HIGHcorrect buffer checks for DM_OP hypercallsEPSS 0.3%CVE-2025-2149LOWPyTorch Quantized Sigmoid Module nnq_Sigmoid initializationEPSS 0.3%CVE-2025-46553LOW@misskey-dev/summaly Redirect Filter BypassEPSS 0.2%CVE-2022-32823MEDIUMA memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11EPSS 0.2%CVE-2021-26312—Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory iEPSS 0.2%CVE-2021-33636HIGHLoad malicious images may cause process to be hijackedEPSS 0.2%CVE-2021-29613MEDIUMIncomplete validation in `tf.raw_ops.CTCLoss`EPSS 0.2%