Weaknesses of type CWE-909

15 results

Inicialização ausente de recurso

Ocorre quando um recurso (memória, arquivo, conexão de banco de dados, etc.) é utilizado sem ser inicializado adequadamente antes do uso. Isso deixa o recurso em estado indefinido, causando comportamentos impredizíveis, corrupção de dados ou até execução não autorizada de código.

Example

Um buffer declarado mas não preenchido é passado a uma função que o lê esperando dados válidos; ou uma variável de controle de acesso não é zerada antes de ser usada em uma verificação de segurança, permitindo bypass.

How to mitigate

Sempre inicialize explicitamente recursos antes do uso — atribua valores padrão seguros em declaração ou logo após alocação. Use ferramentas de análise estática e sanitizadores (ASAN, Valgrind) para detectar leitura de memória não inicializada durante testes.

CVE-2019-3804HIGHIt was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. AnEPSS 4.9%CVE-2021-28167—In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain EPSS 1.1%CVE-2020-12523MEDIUMPhoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configurationEPSS 0.9%CVE-2024-8178CRITICALMultiple issues in ctl(4) CAM Target LayerEPSS 0.6%CVE-2024-53845MEDIUMAES/CBC Constant IV Vulnerability in ESPTouch v2EPSS 0.6%CVE-2022-0382—An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPCEPSS 0.4%CVE-2026-40687MEDIUMIn Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write thatEPSS 0.4%CVE-2024-27913MEDIUMospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash)EPSS 0.3%CVE-2022-0175—A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-bEPSS 0.3%CVE-2021-3655—A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow theEPSS 0.3%CVE-2025-8117HIGHAccount Takeover via Reset Password Functionality in PAD CMSEPSS 0.3%CVE-2024-32945LOWLaTeX post content manipulation via renderer state leak across contextsEPSS 0.2%CVE-2025-54388MEDIUMMoby's Firewalld reload makes published container ports accessible from remote hostsEPSS 0.2%CVE-2024-52870HIGHTeradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionalityEPSS 0.2%CVE-2025-54410LOWMoby's Firewalld reload removes bridge network isolationEPSS 0.2%