Falhas do tipo CWE-665

148 resultados

Inicialização inadequada de recursos

O software falha em inicializar corretamente um recurso (memória, arquivo, conexão, variável) ou não o inicializa antes de usá-lo, deixando-o em estado indefinido. Isso pode levar a comportamentos imprevisíveis, leitura de dados lixo, corrupção de estado ou exploração de segurança quando o recurso é acessado ou manipulado.

Exemplo

Um buffer alocado dinamicamente que nunca é zerado antes de usar em operações criptográficas, permitindo que dados sensíveis anteriormente armazenados naquele espaço de memória vaze. Ou uma estrutura de configuração que não inicializa seus campos, deixando ponteiros inválidos que podem ser dereferenciados.

Como mitigar

Sempre inicialize explicitamente todo recurso no momento da criação ou alocação (memset, construtores, atribuições de valor padrão). Use ferramentas estáticas (lint, compilador com warnings, SAST) para detectar variáveis não inicializadas e valide estados esperados antes de usar qualquer recurso.

CVE-2022-0847HIGHA flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe EPSS 88.6%KEVCVE-2022-22719—mod_lua Use of uninitialized value of in r:parsebodyEPSS 69.8%CVE-2022-46164CRITICALAccount takeover via prototype vulnerabilityEPSS 49.0%CVE-2020-27950MEDIUMA memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security UEPSS 16.5%KEVCVE-2018-14647MEDIUMPython's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial oEPSS 11.3%CVE-2013-1675MEDIUMMozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properEPSS 6.7%KEVCVE-2018-10915HIGHA vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between coEPSS 5.2%CVE-2023-1719HIGHBitrix24 Insecure Global Variable ExtractionEPSS 5.0%CVE-2022-21724HIGHUnchecked Class Instantiation when providing Plugin ClassesEPSS 3.0%CVE-2019-8259—UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be EPSS 3.0%CVE-2022-36364—Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vectorEPSS 3.0%CVE-2019-8277—UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can beEPSS 3.0%CVE-2019-15681—LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker tEPSS 2.9%CVE-2018-14282—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 2.8%CVE-2018-10484—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.7%CVE-2018-1175—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User iEPSS 2.7%CVE-2018-1174—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User iEPSS 2.6%CVE-2019-1840HIGHCisco Prime Network Registrar Denial of Service VulnerabilityEPSS 2.4%CVE-2016-9594MEDIUMcurl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. EPSS 2.3%CVE-2020-10725HIGHA flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend appliEPSS 2.2%