Fallos del tipo CWE-672

64 resultados

Operação em recurso após expiração ou liberação

A aplicação tenta usar um recurso (conexão, arquivo, memória, token, etc.) após ele ter sido liberado, expirado ou se tornado inválido. O código não verifica se o recurso ainda está disponível antes de acessá-lo, causando comportamentos imprevíveis: crash, corrupção de dados ou exploração de segurança.

Ejemplo

Um programa fecha uma conexão com banco de dados em uma thread, mas outra thread continua tentando executar queries usando a mesma conexão. Ou uma aplicação web usa um token de autenticação após seu tempo de expiração ter passado sem revalidar.

Cómo mitigar

Sempre valide o estado do recurso antes de usá-lo (check se está ativo, não expirou, não foi liberado). Use gerenciadores de recurso com escopo claro (finally, context managers em Python, try-with-resources em Java) e implemente timeouts com lógica de renewal para recursos sensíveis à expiração.

CVE-2025-6031HIGHInsecure device pairing in end of life Amazon Cloud CamEPSS 0.3%CVE-2026-19538HIGHBypass of BLOCKED ACL items on proxy protocol port over TCP or TLSEPSS 0.3%CVE-2026-53637MEDIUMSylius: Cart FormComponent allows modification or deletion of an already-completed orderEPSS 0.3%CVE-2024-23332MEDIUMClient configured with permissive trust policies susceptible to rollback attack in Notary ProjectEPSS 0.3%CVE-2026-45005MEDIUMOpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After RotationEPSS 0.3%CVE-2025-69415HIGHIn Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether EPSS 0.3%CVE-2023-34326HIGHx86/AMD: missing IOMMU TLB flushingEPSS 0.3%CVE-2026-47087LOWAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted EPSS 0.3%CVE-2026-30978HIGHHeap-use-after-free in CIccCmm::AddXform()EPSS 0.3%CVE-2026-44725MEDIUMEMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code executionEPSS 0.3%CVE-2026-61699HIGHnebula-mesh: Certificate revocation is never enforced at the meshEPSS 0.2%CVE-2026-33463MEDIUMOperation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File AccessEPSS 0.2%CVE-2026-32244MEDIUMDiscourse: Cached outdated summaries can leak removed contentEPSS 0.2%CVE-2026-85044MEDIUMUse of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineeEPSS 0.2%CVE-2026-2379HIGHArista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is DisabledEPSS 0.2%CVE-2026-50575HIGHBetterDesk has a replay behavior vulnerability when devices are deletedEPSS 0.2%CVE-2025-31253HIGHThis issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a EPSS 0.2%CVE-2026-1629MEDIUMPermalink Preview Information Disclosure After Permission RevocationEPSS 0.2%CVE-2024-56674MEDIUMvirtio_net: correct netdev_tx_reset_queue() invocation pointEPSS 0.2%CVE-2026-42955LOWExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue recordsEPSS 0.2%