Weakness (CWE)
CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
How to prevent it (1 mitigation)
-
Architecture and Design, Implementation
Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
Source: MITRE CWE-459
164 results · Feed
-
Medium 5.5
Incomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentia…
-
High 7.4
A vulnerability in the multicast DNS (mDNS) gateway feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs…
-
Medium 5.9
Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Wi…
-
Medium 6.3
Apache Tomcat: WebSocket DoS with incomplete closing handshake
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, fr…
-
Medium 4.8
PHOENIX CONTACT: Privilege gain through incomplete cleanup in CHARX Series
An unauthenticated remote attacker can gain service level privileges through an incomplete cleanup during service restart after a DoS.
-
Low 3.3
Grub2: grub2-set-bootflag can be abused by local (pseudo-)users
A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename o…
-
Medium 6.5
Junos OS: BGP flap on NSR-enabled devices causes memory leak
An Incomplete Cleanup vulnerability in Nonstop active routing (NSR) component of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause memory leak leading to Denial of Service (DoS). On all Junos OS platforms, when NSR is enabled, a …
-
High 7.5
Apache Struts: excessive disk usage
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.…
-
Low 1.9
Incomplete cleanup for some Intel Unison software may allow a privileged user to potentially enable denial of service v…
-
Low 3.3
Incomplete cleanup for some Intel Unison software may allow an authenticated user to potentially enable information dis…
-
Medium 5.3
Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomc…
-
Medium 5.9
Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows
Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service o…
-
Critical 10.0
Upgrading doesn't prevent exploiting vulnerable XWiki documents
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some case…
-
Low 2.7
Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an admin…
-
Low 1.8
Incomplete cleanup in the Intel(R) IPP Cryptography software before version 2021.6 may allow a privileged user to poten…
-
Medium 6.3
Spring Security logout not clearing security context
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly s…
-
High 7.5
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before …
-
Medium 6.5
redis-py Race Condition due to incomplete fix
redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operatio…
-
Medium 6.6
Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber…
-
Medium 6.5
Junos OS and Junos OS Evolved: An RPD crash can happen due to an MPLS TE tunnel configuration change on a directly connected router
An Incomplete Cleanup vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). An rpd crash can occur when an MPLS TE tunnel configura…
-
Critical 9.8
Apache ShardingSphere-Proxy: MySQL authentication bypass
Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. Thi…
-
High 7.8
A double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneo…
-
Medium 5.4
Incomplete cleanup in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privile…
-
High 8.2
Californium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of records
Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of Service. Failing handshakes don't cleanup counters for throttlin…
-
High 7.5
The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Suc…
-
Medium 6.2
Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, …
-
Unscored —CVE-2022-1552 EPSS 17%
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is m…
-
Unscored —
A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-l…
-
Medium 4.4
Incomplete cleanup in a firmware subsystem for Intel(R) SPS before versions SPS_E3_04.08.04.330.0 and SPS_E3_04.01.04.5…
-
Medium 5.5
Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticate…
-
Medium 5.5
Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated…
-
Medium 5.5
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to po…
-
Medium 5.5
Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potenti…
-
High 7.5
Resource leakage when decoding certificates and keys
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes cer…
-
High 8.1
Metasys session token
Under certain circumstances the session token is not cleared on logout.
-
Unscored —
A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memo…
-
Unscored —
A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way…
-
Unscored —
A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure all…
-
Critical 9.8
Memory flaw in zeroize_derive
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
-
Unscored —
The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License M…