Falhas do tipo CWE-665

166 resultados

Inicialização inadequada de recursos

O software falha em inicializar corretamente um recurso (memória, arquivo, conexão, variável) ou não o inicializa antes de usá-lo, deixando-o em estado indefinido. Isso pode levar a comportamentos imprevisíveis, leitura de dados lixo, corrupção de estado ou exploração de segurança quando o recurso é acessado ou manipulado.

Exemplo

Um buffer alocado dinamicamente que nunca é zerado antes de usar em operações criptográficas, permitindo que dados sensíveis anteriormente armazenados naquele espaço de memória vaze. Ou uma estrutura de configuração que não inicializa seus campos, deixando ponteiros inválidos que podem ser dereferenciados.

Como mitigar

Sempre inicialize explicitamente todo recurso no momento da criação ou alocação (memset, construtores, atribuições de valor padrão). Use ferramentas estáticas (lint, compilador com warnings, SAST) para detectar variáveis não inicializadas e valide estados esperados antes de usar qualquer recurso.

CVE-2023-4503MEDIUMEap-galleon: custom provisioning creates unsecured http-invokerEPSS 0.7%CVE-2022-22164MEDIUMJunos OS Evolved: Telnet service may be enabled when it is expected to be disabled.EPSS 0.7%CVE-2023-37479MEDIUMImproper sanitization of MXCSR and RFLAGS in OpenEnclaveEPSS 0.7%CVE-2026-64775CRITICALA memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15EPSS 0.7%CVE-2022-39384MEDIUMOpenZeppelin Contracts initializer reentrancy may lead to double initializationEPSS 0.7%CVE-2022-22186HIGHJunos OS: EX4650 Series: Certain traffic received by the Junos OS device on the management interface may be forwarded to egress interfaces instead of discardedEPSS 0.6%CVE-2019-1761MEDIUMCisco IOS and IOS XE Software Hot Standby Router Protocol Information Leak VulnerabilityEPSS 0.6%CVE-2023-23555HIGHBIG-IP Virtual Edition vulnerabilityEPSS 0.6%CVE-2023-22466MEDIUMTokio's reject_remote_clients configuration may get dropped when creating a Windows named pipeEPSS 0.6%CVE-2022-46487HIGHImproper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for IntelEPSS 0.6%CVE-2023-1048MEDIUMTechPowerUp Ryzen DRAM Calculator WinRing0x64.sys initializationEPSS 0.6%CVE-2022-3259HIGHOpenshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.EPSS 0.6%CVE-2021-33635CRITICALPull malicious images may cause process to be hijackedEPSS 0.6%CVE-2025-66363HIGHAn issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. There was no check for memory initialization within DL NAS TransportEPSS 0.6%CVE-2025-14955MEDIUMOpen5GS PFCP handler.c ogs_pfcp_handle_create_pdr initializationEPSS 0.6%CVE-2026-101957HIGHJunos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is usedEPSS 0.5%CVE-2026-53398CRITICALNFSD: Fix SECINFO_NO_NAME decode error cleanupEPSS 0.5%CVE-2023-3242HIGHImproper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated netwEPSS 0.5%CVE-2018-10901HIGHA flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, butEPSS 0.5%CVE-2026-12233MEDIUMUninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contentionEPSS 0.5%