Fallos del tipo CWE-672

81 resultados

Operação em recurso após expiração ou liberação

A aplicação tenta usar um recurso (conexão, arquivo, memória, token, etc.) após ele ter sido liberado, expirado ou se tornado inválido. O código não verifica se o recurso ainda está disponível antes de acessá-lo, causando comportamentos imprevíveis: crash, corrupção de dados ou exploração de segurança.

Ejemplo

Um programa fecha uma conexão com banco de dados em uma thread, mas outra thread continua tentando executar queries usando a mesma conexão. Ou uma aplicação web usa um token de autenticação após seu tempo de expiração ter passado sem revalidar.

Cómo mitigar

Sempre valide o estado do recurso antes de usá-lo (check se está ativo, não expirou, não foi liberado). Use gerenciadores de recurso com escopo claro (finally, context managers em Python, try-with-resources em Java) e implemente timeouts com lógica de renewal para recursos sensíveis à expiração.

CVE-2025-30351LOWSuspended Directus user can continue to use session token to access APIEPSS 0.4%CVE-2026-44725MEDIUMEMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code executionEPSS 0.4%CVE-2026-53637MEDIUMSylius: Cart FormComponent allows modification or deletion of an already-completed orderEPSS 0.4%CVE-2024-25619LOWDestroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodonEPSS 0.4%CVE-2026-113121HIGHUse of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social enEPSS 0.4%CVE-2013-10075CRITICALApache::Session versions through 1.94 for Perl re-creates deleted sessionsEPSS 0.4%CVE-2026-113216HIGHUse of released resource in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer prEPSS 0.3%CVE-2024-4693MEDIUMQemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crashEPSS 0.3%CVE-2026-42791MEDIUMOCSP responder certificate validity period not checked in public_keyEPSS 0.3%CVE-2026-30978HIGHHeap-use-after-free in CIccCmm::AddXform()EPSS 0.3%CVE-2026-85044MEDIUMUse of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineeEPSS 0.3%CVE-2025-6031HIGHInsecure device pairing in end of life Amazon Cloud CamEPSS 0.3%CVE-2026-93006MEDIUMDnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file contentEPSS 0.3%CVE-2026-121256HIGHUse of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process tEPSS 0.3%CVE-2024-23332MEDIUMClient configured with permissive trust policies susceptible to rollback attack in Notary ProjectEPSS 0.3%CVE-2026-45005MEDIUMOpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After RotationEPSS 0.3%CVE-2026-47087LOWAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted EPSS 0.3%CVE-2025-69415HIGHIn Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether EPSS 0.3%CVE-2023-34326HIGHx86/AMD: missing IOMMU TLB flushingEPSS 0.3%CVE-2026-79010MEDIUMOperation on a resource after expiration or release in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had comEPSS 0.3%