Falhas do tipo CWE-457

245 resultados

Uso de variável não inicializada

Quando o código usa uma variável antes de atribuir um valor válido a ela, o programa pode ler lixo de memória (valores aleatórios deixados por outras operações). Isso leva a comportamentos imprevisíveis, falhas, ou no pior caso, a exploração de segurança quando o atacante consegue controlar o que está naquela posição de memória.

Exemplo

Um buffer local declarado em C sem inicialização (char buf[256];) é usado logo depois em memcpy ou sprintf. Se o conteúdo anterior daquela pilha contiver dados sensíveis ou endereços, um vazamento de informação ou corrupção de fluxo de controle pode ocorrer.

Como mitigar

Inicialize sempre as variáveis na declaração (char buf[256] = {0}; ou int x = 0;). Use análise estática (linters, compiler warnings, ferramentas como clang-analyzer) para detectar uso de variáveis não inicializadas antes do deploy. Em linguagens gerenciadas como Java/C#, o compilador já força isso.

CVE-2023-31192MEDIUMAn information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network EPSS 1.0%CVE-2024-32611CRITICALHDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c.EPSS 1.0%CVE-2022-28319HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034.EPSS 0.9%CVE-2022-28320HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interactioEPSS 0.9%CVE-2024-26147HIGHHelm's Missing YAML Content Leads To PanicEPSS 0.9%CVE-2024-6990HIGHUninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds EPSS 0.9%CVE-2020-27124HIGHCisco Adaptive Security Appliance Software SSL/TLS Denial of Service VulnerabilityEPSS 0.9%CVE-2021-44003—A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_LoadeEPSS 0.8%CVE-2022-34655HIGHTMM vulnerability CVE-2022-34655EPSS 0.7%CVE-2023-6324HIGHThroughTek Kalay SDK error in handling the PSK identityEPSS 0.7%CVE-2024-26882HIGHnet: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()EPSS 0.7%CVE-2025-20212HIGHA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remoteEPSS 0.7%CVE-2022-28317HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 0.6%CVE-2026-91963HIGHFreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrcEPSS 0.6%CVE-2025-54874MEDIUMOpenJPEG allows OOB heap memory write in opj_jp2_read_headerEPSS 0.6%CVE-2021-3928HIGHUse of Uninitialized Variable in vim/vimEPSS 0.6%CVE-2022-42432MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attackEPSS 0.6%CVE-2025-56364HIGHA use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().ValueEPSS 0.6%CVE-2025-20271HIGHCisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service VulnerabilityEPSS 0.5%CVE-2024-29838HIGHUnsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crashEPSS 0.5%