Fallos del tipo CWE-665

153 resultados

Inicialização incorreta ou ausente de recursos

Ocorre quando um recurso (variável, buffer, conexão, arquivo) não é inicializado ou é inicializado de forma incompleta antes do uso, deixando-o em estado indeterminado. Isso pode levar a comportamentos imprevisíveis, vazamento de dados sensíveis ou crashes, pois o código tenta usar valores aleatórios ou valores de memória anterior.

Ejemplo

Um desenvolvedor declara um buffer para armazenar credenciais, mas esquece de zerar sua memória antes de preenchê-lo; se o código ler dessa memória antes de atribuir um valor válido, pode expor dados de sessões anteriores. Ou uma variável booleana que controla acesso é usada sem ser definida, assumindo um valor aleatório de memória.

Cómo mitigar

Sempre inicialize explicitamente recursos no ponto de declaração ou antes do primeiro uso: atribua valores padrão seguros, use construtores ou funções de setup específicas. Ferramentas de análise estática (lint, SAST) e testes com sanitizers de memória ajudam a detectar usos sem inicialização.

CVE-2021-36319LOWDell Networking OS10 versions 10.4.3.x, 10.5.0.x and 10.5.1.x contain an information exposure vulnerability. A low privileged authenticated EPSS 0.2%CVE-2024-0089HIGHCVEEPSS 0.2%CVE-2021-29609MEDIUMIncomplete validation in `SparseAdd`EPSS 0.2%CVE-2024-31157MEDIUMImproper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable iEPSS 0.2%CVE-2024-11158HIGHRockwell Automation Arena® Uninitialized VulnerabilityEPSS 0.2%CVE-2023-1513LOWA flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_EPSS 0.2%CVE-2024-26021MEDIUMImproper initialization in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentiallyEPSS 0.2%CVE-2020-35508—A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identEPSS 0.2%CVE-2021-29614HIGHInterpreter crash from `tf.io.decode_raw`EPSS 0.2%CVE-2023-45315MEDIUMImproper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user to potentially enablEPSS 0.2%CVE-2022-27493HIGHImproper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially eEPSS 0.2%CVE-2022-45109LOWImproper initialization for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via locaEPSS 0.2%CVE-2025-25947MEDIUMAn issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_AtomParent::RemoveChilEPSS 0.2%CVE-2026-44434MEDIUMQuicly is vulnerable to stateless reset injectionEPSS 0.2%CVE-2021-33638HIGHRun copy with container in a malicious directory may cause container escapingEPSS 0.2%CVE-2021-33637HIGHExport container in a malicious directory may cause process to be hijackedEPSS 0.2%CVE-2023-27306MEDIUMImproper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow an authenticated user to potentially enable denial oEPSS 0.2%CVE-2021-29611LOWIncomplete validation in `SparseReshape`EPSS 0.2%CVE-2021-29610LOWInvalid validation in `QuantizeAndDequantizeV2`EPSS 0.2%CVE-2023-28737HIGHImproper initialization in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable escalEPSS 0.2%