Fallos del tipo CWE-459

87 resultados

Limpeza Incompleta de Recursos

Ocorre quando uma aplicação não libera completamente recursos (memória, arquivos, conexões, sessões) ao encerrar um processo ou função, deixando dados sensíveis ou ocupação residual no sistema. Isso pode levar a vazamento de memória, exposição de informações confidenciais ou degradação de desempenho.

Ejemplo

Uma função abre uma conexão com banco de dados dentro de um bloco try-catch, mas se uma exceção é lançada, a conexão nunca é fechada. Ou um arquivo temporário contendo credenciais é deletado, mas o buffer em memória não é zerado, permitindo recuperação forense.

Cómo mitigar

Use padrões como try-with-resources (Java), context managers (Python), ou defer (Go) para garantir limpeza automática. Implemente finally blocks explícitos, zero-out buffers com dados sensíveis e valide que todos os recursos foram liberados em testes de integração.

CVE-2024-50385MEDIUMA denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A speEPSS 0.7%CVE-2024-50384MEDIUMA denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A speEPSS 0.7%CVE-2026-28268CRITICALVikunja Vulnerable to Account Takeover via Password Reset Token ReuseEPSS 0.7%CVE-2026-3304HIGHMulter vulnerable to Denial of Service via incomplete cleanupEPSS 0.7%CVE-2023-20862MEDIUMIn Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support doesEPSS 0.6%CVE-2024-26005MEDIUMPHOENIX CONTACT: Privilege gain through incomplete cleanup in CHARX SeriesEPSS 0.6%CVE-2026-34263CRITICALMissing authentication check in SAP Commerce cloud configurationEPSS 0.6%CVE-2025-21609HIGHSiYuan has an arbitrary file deletion vulnerabilityEPSS 0.6%CVE-2025-66675HIGHApache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixedEPSS 0.6%CVE-2022-39368HIGHCalifornium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of recordsEPSS 0.6%CVE-2021-4002—A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmgetEPSS 0.5%CVE-2026-42492HIGHvIRQ event channel binding may break XenstoreEPSS 0.5%CVE-2022-44546HIGHThe kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation EPSS 0.5%CVE-2024-28265CRITICALIBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.EPSS 0.5%CVE-2026-11576HIGHThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanEPSS 0.5%CVE-2025-0473MEDIUMIncomplete Cleanup vulnerability in PMB platformEPSS 0.5%CVE-2023-2400LOWImproper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view useEPSS 0.4%CVE-2024-2403MEDIUM Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attaEPSS 0.4%CVE-2019-5011HIGHAn exploitable privilege escalation vulnerability exists in the helper service CleanMyMac X, version 4.20, due to improper updating. The appEPSS 0.4%CVE-2026-33232HIGHAutoGPT: Unauthenticated DoS via Disk Space ExhaustionEPSS 0.4%