Weakness (CWE)
CWE-244: Improper Clearing of Heap Memory Before Release
The product uses realloc() to resize buffers that contain sensitive information.
Source: MITRE CWE-244
15 results · Clear filters · Feed
-
Medium 4.7
IBM Concert Software Improper Clearing of Heap Memory
IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection.
-
Medium 6.9
nebula-mesh: Decrypted CA private key persists in heap after signing
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.…
-
Medium 5.9
Multiple Vulnerabilities in IBM Concert Software.
IBM Concert 1.0.0 through 2.1.0 could allow an attacker to obtain sensitive information using man in the middle techniques due to improper clearing of heap memory.
-
Medium 5.9
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.
-
Medium 5.9
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.
-
Medium 5.9
BM Concert Software Improper Clearing of Heap Memory Before Release.
IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.
-
Medium 6.5
An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure.
-
Medium 6.2
Multiple Vulnerabilities in IBM Concert Software.
IBM Concert Software 1.0.0 through 2.0.0 could allow a local user to obtain sensitive information from buffers due to improper clearing of heap memory before release.
-
Medium 5.9
IBM Concert Software information disclosure
IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.
-
Medium 6.2
IBM MQ Operator information disclosure
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clear…
-
Medium 4.0
A vulnerability in the TLS 1.3 implementation of the Cisco Firepower Threat Defense (FTD) Software could allow an unaut…
-
Medium 4.0
A vulnerability in the SSL/TLS certificate handling of Snort 3 Detection Engine integration with Cisco Firepower Threat…
-
Medium 4.0
A vulnerability in the SSL file policy implementation of Cisco Firepower Threat Defense (FTD) Software that occurs when…
-
Medium 5.8
Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multip…
-
Medium 5.8
Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multip…