Weakness (CWE)
CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
How to prevent it (1 mitigation)
-
Architecture and Design, Implementation
Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
Source: MITRE CWE-459
71 results · Clear filters · Feed
-
Medium 5.3
A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries…
-
Medium 5.3
A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for…
-
Medium 6.3
CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.
-
Medium 6.5
A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-A…
-
Medium 6.5
A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-A…
-
Medium 6.5
Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over me…
-
Medium 5.5
NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt stor…
-
Medium 5.5
NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A su…
-
Medium 6.5
Incomplete Cleanup vulnerability in PMB platform
Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimport_authorities’ endpoint. …
-
Medium 4.0
Vulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this …
-
Medium 4.4
Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, pot…
-
Medium 5.5
Incomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentia…
-
Medium 5.9
Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Wi…
-
Medium 6.3
Apache Tomcat: WebSocket DoS with incomplete closing handshake
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, fr…
-
Medium 4.8
PHOENIX CONTACT: Privilege gain through incomplete cleanup in CHARX Series
An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS.
-
Medium 6.5
Junos OS: BGP flap on NSR-enabled devices causes memory leak
An Incomplete Cleanup vulnerability in Nonstop active routing (NSR) component of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause memory leak leading to Denial of Service (DoS). On all Junos OS platforms, when NSR is enabled, a …
-
Medium 5.3
Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomc…
-
Medium 5.9
Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows
Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service o…
-
Medium 6.3
Spring Security logout not clearing security context
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly s…
-
Medium 6.5
redis-py Race Condition due to incomplete fix
redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operatio…
-
Medium 6.6
Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber…
-
Medium 6.5
Junos OS and Junos OS Evolved: An RPD crash can happen due to an MPLS TE tunnel configuration change on a directly connected router
An Incomplete Cleanup vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). An rpd crash can occur when an MPLS TE tunnel configura…
-
Medium 5.4
Incomplete cleanup in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privile…
-
Medium 6.2
Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, …
-
Medium 4.4
Incomplete cleanup in a firmware subsystem for Intel(R) SPS before versions SPS_E3_04.08.04.330.0 and SPS_E3_04.01.04.5…
-
Medium 5.5
Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticate…
-
Medium 5.5
Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated…
-
Medium 5.5
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to po…
-
Medium 5.5
Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potenti…
-
Medium 5.3
Beckhoff: Etherleak in TwinCAT RT network driver
Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are n…
-
Medium 5.0
Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault fi…