Falhas do tipo CWE-665

153 resultados

Inicialização inadequada de recursos

O software falha em inicializar corretamente um recurso (memória, arquivo, conexão, variável) ou não o inicializa antes de usá-lo, deixando-o em estado indefinido. Isso pode levar a comportamentos imprevisíveis, leitura de dados lixo, corrupção de estado ou exploração de segurança quando o recurso é acessado ou manipulado.

Exemplo

Um buffer alocado dinamicamente que nunca é zerado antes de usar em operações criptográficas, permitindo que dados sensíveis anteriormente armazenados naquele espaço de memória vaze. Ou uma estrutura de configuração que não inicializa seus campos, deixando ponteiros inválidos que podem ser dereferenciados.

Como mitigar

Sempre inicialize explicitamente todo recurso no momento da criação ou alocação (memset, construtores, atribuições de valor padrão). Use ferramentas estáticas (lint, compilador com warnings, SAST) para detectar variáveis não inicializadas e valide estados esperados antes de usar qualquer recurso.

CVE-2020-4067HIGHImproper Initialization in coturnEPSS 1.9%CVE-2024-39864CRITICALApache CloudStack: Integration API service uses dynamic port when disabledEPSS 1.8%CVE-2020-1617HIGHJunos OS: PTX1000 and PTX10000 Series, QFX10000 Series using non-AFT architectures: A specific genuine packet inspected by sFlow will cause a reboot.EPSS 1.6%CVE-2021-41264CRITICALUUPSUpgradeable vulnerability in OpenZeppelin ContractsEPSS 1.5%CVE-2019-10196—A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer construEPSS 1.4%CVE-2021-34697MEDIUMCisco IOS XE Software Protection Against Distributed Denial of Service Attacks Feature VulnerabilityEPSS 1.3%CVE-2021-3565—A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentiallEPSS 1.3%CVE-2022-24316—A CWE-665: Improper Initialization vulnerability exists that could cause information exposure when an attacker sends a specially crafted mesEPSS 1.3%CVE-2022-36061MEDIUMElrond go can execute on same context checks in VMEPSS 1.2%CVE-2020-25662MEDIUMA Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initializaEPSS 1.2%CVE-2022-1122—A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. WhEPSS 1.1%CVE-2021-0280HIGHJunos OS: PTX Series, QFX10K Series: Upon receipt of specific packets BFD sessions might flap due to DDoS policer implementation in Packet Forwarding EngineEPSS 1.0%CVE-2021-0234MEDIUMJunos OS: QFX5100-96S: DDoS protection does not work as expected.EPSS 0.9%CVE-2024-28084HIGHp2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon crash) or possibly have unspecifiEPSS 0.9%CVE-2022-39284LOWSecure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4EPSS 0.9%CVE-2022-43468HIGHExternal initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore theEPSS 0.9%CVE-2021-0226HIGHJunos OS Evolved: The IPv6 BGP session will flap due to receipt of a specific IPv6 packetEPSS 0.9%CVE-2022-0947CRITICALArctic Wireless Gateway Firewall vulnerabilityEPSS 0.9%CVE-2022-46505HIGHAn issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero EPSS 0.9%CVE-2022-22169MEDIUMJunos OS and Junos OS Evolved: OSPFv3 session might go into INIT state upon receipt of multiple crafted packets from a trusted neighbor device.EPSS 0.8%