Falhas do tipo CWE-665

153 resultados

Inicialização inadequada de recursos

O software falha em inicializar corretamente um recurso (memória, arquivo, conexão, variável) ou não o inicializa antes de usá-lo, deixando-o em estado indefinido. Isso pode levar a comportamentos imprevisíveis, leitura de dados lixo, corrupção de estado ou exploração de segurança quando o recurso é acessado ou manipulado.

Exemplo

Um buffer alocado dinamicamente que nunca é zerado antes de usar em operações criptográficas, permitindo que dados sensíveis anteriormente armazenados naquele espaço de memória vaze. Ou uma estrutura de configuração que não inicializa seus campos, deixando ponteiros inválidos que podem ser dereferenciados.

Como mitigar

Sempre inicialize explicitamente todo recurso no momento da criação ou alocação (memset, construtores, atribuições de valor padrão). Use ferramentas estáticas (lint, compilador com warnings, SAST) para detectar variáveis não inicializadas e valide estados esperados antes de usar qualquer recurso.

CVE-2023-4503MEDIUMEap-galleon: custom provisioning creates unsecured http-invokerEPSS 0.7%CVE-2022-22164MEDIUMJunos OS Evolved: Telnet service may be enabled when it is expected to be disabled.EPSS 0.7%CVE-2023-37479MEDIUMImproper sanitization of MXCSR and RFLAGS in OpenEnclaveEPSS 0.7%CVE-2022-22186HIGHJunos OS: EX4650 Series: Certain traffic received by the Junos OS device on the management interface may be forwarded to egress interfaces instead of discardedEPSS 0.6%CVE-2019-1761MEDIUMCisco IOS and IOS XE Software Hot Standby Router Protocol Information Leak VulnerabilityEPSS 0.6%CVE-2023-23555HIGHBIG-IP Virtual Edition vulnerabilityEPSS 0.6%CVE-2022-46487HIGHImproper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for IntelEPSS 0.6%CVE-2023-1048MEDIUMTechPowerUp Ryzen DRAM Calculator WinRing0x64.sys initializationEPSS 0.6%CVE-2023-22466MEDIUMTokio's reject_remote_clients configuration may get dropped when creating a Windows named pipeEPSS 0.6%CVE-2025-14955MEDIUMOpen5GS PFCP handler.c ogs_pfcp_handle_create_pdr initializationEPSS 0.6%CVE-2021-33635CRITICALPull malicious images may cause process to be hijackedEPSS 0.6%CVE-2026-64775CRITICALA memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15EPSS 0.6%CVE-2022-3259HIGHOpenshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.EPSS 0.5%CVE-2023-3242HIGHImproper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated netwEPSS 0.5%CVE-2022-39384MEDIUMOpenZeppelin Contracts initializer reentrancy may lead to double initializationEPSS 0.5%CVE-2018-10901HIGHA flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, butEPSS 0.5%CVE-2025-66363HIGHAn issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. There was no check for memory initialization within DL NAS TransportEPSS 0.5%CVE-2024-36455CRITICALSymantec Privileged Access Manager Remote Command Execution vulnerabilityEPSS 0.5%CVE-2022-48352HIGHSome smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic.EPSS 0.5%CVE-2026-54409HIGHA malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UnEPSS 0.4%