Fallos del tipo CWE-908

345 resultados

Uso de recurso não inicializado

O código utiliza uma variável, buffer, ponteiro ou outro recurso sem atribuir um valor inicial válido. Isso causa comportamento imprevisível: o programa lê lixo de memória ou executa operações com dados aleatórios, podendo levar a falhas, vazamento de informação ou execução de código arbitrário.

Ejemplo

Um desenvolvedor declara um array local sem zerá-lo e o passa diretamente para uma função criptográfica; a função processa dados lixo da stack anterior, compromentendo a segurança da operação criptográfica. Ou um ponteiro é usado antes de ser alocado, causando acesso a endereço de memória inválido.

Cómo mitigar

Inicialize sempre variáveis no ponto de declaração (em C/C++: use memset, calloc ou atribua valores válidos; em linguagens gerenciadas, confie no runtime). Use analisadores estáticos (como Clang Static Analyzer ou Coverity) para detectar leitura sem inicialização; implemente code review obrigatório para declarações de recursos.

CVE-2018-25014—A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().EPSS 2.2%CVE-2025-62472HIGHWindows Remote Access Connection Manager Elevation of Privilege VulnerabilityEPSS 2.2%CVE-2024-38064HIGHWindows TCP/IP Information Disclosure VulnerabilityEPSS 2.2%CVE-2026-3497LOWVulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by vaEPSS 2.2%CVE-2025-21220HIGHMicrosoft Message Queuing Information Disclosure VulnerabilityEPSS 2.2%CVE-2023-36567HIGHWindows Deployment Services Information Disclosure VulnerabilityEPSS 2.0%CVE-2023-36012MEDIUMDHCP Server Service Information Disclosure VulnerabilityEPSS 2.0%CVE-2023-35325HIGHWindows Print Spooler Information Disclosure VulnerabilityEPSS 1.8%CVE-2025-27474MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.8%CVE-2023-38151HIGHMicrosoft Host Integration Server 2020 Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-43458HIGHWindows Networking Information Disclosure VulnerabilityEPSS 1.8%CVE-2023-36913MEDIUMMicrosoft Message Queuing Information Disclosure VulnerabilityEPSS 1.7%CVE-2023-24886HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-38260HIGHWindows Remote Desktop Licensing Service Remote Code Execution VulnerabilityEPSS 1.6%CVE-2020-27795—A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when command "adf" has no or wrong argument, anal_EPSS 1.5%CVE-2025-29959MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.4%CVE-2023-32042MEDIUMOLE Automation Information Disclosure VulnerabilityEPSS 1.3%CVE-2025-29958MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.3%CVE-2025-53719MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.3%CVE-2023-23413HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.3%