Falhas do tipo CWE-665

166 resultados

Inicialização inadequada de recursos

O software falha em inicializar corretamente um recurso (memória, arquivo, conexão, variável) ou não o inicializa antes de usá-lo, deixando-o em estado indefinido. Isso pode levar a comportamentos imprevisíveis, leitura de dados lixo, corrupção de estado ou exploração de segurança quando o recurso é acessado ou manipulado.

Exemplo

Um buffer alocado dinamicamente que nunca é zerado antes de usar em operações criptográficas, permitindo que dados sensíveis anteriormente armazenados naquele espaço de memória vaze. Ou uma estrutura de configuração que não inicializa seus campos, deixando ponteiros inválidos que podem ser dereferenciados.

Como mitigar

Sempre inicialize explicitamente todo recurso no momento da criação ou alocação (memset, construtores, atribuições de valor padrão). Use ferramentas estáticas (lint, compilador com warnings, SAST) para detectar variáveis não inicializadas e valide estados esperados antes de usar qualquer recurso.

CVE-2023-48361MEDIUMImproper initialization in firmware for some Intel(R) CSME may allow a privileged user to potentially enable information disclosure via locaEPSS 0.2%CVE-2022-38083MEDIUMImproper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information discEPSS 0.2%CVE-2021-22283MEDIUMMMS File Transfer Vulnerability impact on Distribution Automation productsEPSS 0.2%CVE-2022-37334HIGHImproper initialization in BIOS firmware for some Intel(R) NUC 11 Pro Kits and Intel(R) NUC 11 Pro Boards before version TNTGL357.0064 may aEPSS 0.2%CVE-2023-32467MEDIUMDell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with higEPSS 0.2%CVE-2026-31693HIGHcifs: some missing initializations on replayEPSS 0.2%CVE-2022-31477MEDIUMImproper initialization for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via locEPSS 0.2%CVE-2023-40596HIGHSplunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLLEPSS 0.2%CVE-2026-34553MEDIUMiccDEV: DoS in CIccCLUT::Iterate() & CIccMBB::Describe()EPSS 0.2%CVE-2026-20734MEDIUMImproper initialization in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT), and some Intel(R) Standard ManageabiEPSS 0.2%CVE-2026-93495HIGHImproper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a EPSS 0.2%CVE-2025-21100MEDIUMImproper initialization in the UEFI firmware for the Intel(R) Server D50DNP and M50FCP boards may allow a privileged user to potentially enaEPSS 0.2%CVE-2023-27887MEDIUMImproper initialization in BIOS firmware for some Intel(R) NUCs may allow a privileged user to potentially enable information disclosure viaEPSS 0.2%CVE-2023-31926HIGHArbitrary File Overwrite using less commandEPSS 0.2%CVE-2024-36331LOWImproper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulEPSS 0.2%CVE-2025-24511LOWImproper initialization in the Linux kernel-mode driver for some Intel(R) I350 Series Ethernet before version 5.19.2 may allow an authenticaEPSS 0.1%CVE-2026-23253HIGHmedia: dvb-core: fix wrong reinitialization of ringbuffer on reopenEPSS 0.1%CVE-2026-23553LOWx86: incomplete IBPB for vCPU isolationEPSS 0.1%CVE-2026-12539MEDIUMDocker Sandboxes ICMP egress restriction bypass after daemon restartEPSS 0.1%CVE-2025-12902MEDIUMImproper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authoriEPSS 0.1%