Falhas do tipo CWE-399

160 resultados

Erros na Gestão de Recursos

É uma categoria guarda-chuva que engloba falhas na alocação, liberação ou controle adequado de recursos do sistema (memória, arquivos, conexões, handles, etc.). O código aloca um recurso mas falha em devolvê-lo corretamente, deixando-o indisponível ou causando consumo descontrolado até esgotamento.

Exemplo

Uma aplicação abre conexões com banco de dados dentro de um try-catch, mas não as fecha no finally — após múltiplas requisições, todas as conexões disponíveis são consumidas e novas requisições falham. Ou um programa que aloca blocos de memória em loop sem nunca liberar, causando vazamento progressivo até travamento.

Como mitigar

Use mecanismos de limpeza automática: finally blocks ou try-with-resources em Java, context managers em Python, RAII em C++. Implemente monitoramento de recursos (alertas de vazamento), use pools de conexão com limites explícitos e realize testes de carga para detectar esgotamento.

CVE-2017-3826—A vulnerability in the Stream Control Transmission Protocol (SCTP) decoder of the Cisco NetFlow Generation Appliance (NGA) with software befEPSS 1.7%CVE-2017-6628—A vulnerability in SMART-SSL Accelerator functionality for Cisco Wide Area Application Services (WAAS) 6.2.1, 6.2.1a, and 6.2.3a could allowEPSS 1.7%CVE-2017-6615—A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE 3.16 could allow an authenticated, remote attackeEPSS 1.7%CVE-2014-1745HIGHUse-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cEPSS 1.7%CVE-2022-20767HIGHCisco Firepower Threat Defense Software DNS Enforcement Denial of Service VulnerabilityEPSS 1.7%CVE-2018-0290—A vulnerability in the TCP stack of Cisco SocialMiner could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conEPSS 1.7%CVE-2017-12287—A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video CommunicEPSS 1.6%CVE-2017-12211—A vulnerability in the IPv6 Simple Network Management Protocol (SNMP) code of Cisco IOS and Cisco IOS XE Software could allow an authenticatEPSS 1.6%CVE-2020-3168HIGHCisco Nexus 1000V Switch for VMware vSphere Secure Login Enhancements Denial of Service VulnerabilityEPSS 1.6%CVE-2017-12318—A vulnerability in the TCP state machine of Cisco RF Gateway 1 devices could allow an unauthenticated, remote attacker to prevent an affecteEPSS 1.6%CVE-2018-0137—A vulnerability in the TCP throttling process of Cisco Prime Network could allow an unauthenticated, remote attacker to cause a denial of seEPSS 1.6%CVE-2017-12245—A vulnerability in SSL traffic decryption for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker EPSS 1.6%CVE-2018-0397—A vulnerability in Cisco AMP for Endpoints Mac Connector Software installed on Apple macOS 10.12 could allow an unauthenticated, remote attaEPSS 1.5%CVE-2019-16021HIGHCisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesEPSS 1.5%CVE-2018-4851—A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to theEPSS 1.5%CVE-2022-20756HIGHCisco Identity Services Engine RADIUS Service Denial of Service VulnerabilityEPSS 1.5%CVE-2021-1377MEDIUMCisco IOS and IOS XE Software ARP Resource Management Exhaustion Denial of Service VulnerabilityEPSS 1.4%CVE-2017-12256—A vulnerability in the Akamai Connect feature of Cisco Wide Area Application Services (WAAS) Appliances could allow an unauthenticated, remoEPSS 1.4%CVE-2018-15391—Cisco Remote PHY IPv4 Fragment Denial of Service VulnerabilityEPSS 1.4%CVE-2019-15258MEDIUMCisco SPA100 Series Analog Telephone Adapters Web Management Interface Denial of Service VulnerabilityEPSS 1.4%