CWE-664: Improper Control of a Resource Through its Lifetime, page 2
Filter
The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
What the weakness is: CWE-664 at MITRE. All weaknesses
Related attack patterns (CAPEC): 5
- CAPEC-21 Exploitation of Trusted Identifiers Likelihood: High · Severity: High
- CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
- CAPEC-61 Session Fixation Likelihood: Medium · Severity: High
- CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
- CAPEC-196 Session Credential Falsification through Forging Likelihood: Medium · Severity: Medium
The attack patterns MITRE's CAPEC relates to CWE-664, as MITRE names them. Credits.
Ask an AI about CWE-664
Show the prompt
Explain CWE-664: Improper Control of a Resource Through its Lifetime and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/664.html and https://cve.bz/cve/cwe/664?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.5CVE-2022-20856EPSS 1.3%
A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to…
- 6.5CVE-2022-31153EPSS 1.5%
OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue a…
- 7.5CVE-2022-2191EPSS 2.2%
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
- 7.5CVE-2022-2048EPSS 2.6%
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial o…
- 5.3CVE-2022-27512EPSS 1.0%
Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM.
- 5.3CVE-2022-20748EPSS 1.3%
A vulnerability in the local malware analysis process of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. This vulnerability …
- 4.6CVE-2022-1385EPSS 0.8%
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public …
- 4.3CVE-2021-1592EPSS 1.0%
A vulnerability in the way Cisco UCS Manager software handles SSH sessions could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper resource man…
- 3.3CVE-2020-3504EPSS 0.3%
A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper ha…
- 5.5CVE-2020-1622EPSS 0.3%
A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via the EvoSharedObjStore. This issue affects all versions of Junos OS Evolved prior to 19.1R1.
- 5.5CVE-2020-1621EPSS 0.3%
A local, authenticated user with shell can obtain the hashed values of login passwords via configd traces. This issue affects all versions of Junos OS Evolved prior to 19.3R1.
- 5.5CVE-2020-1620EPSS 0.3%
A local, authenticated user with shell can obtain the hashed values of login passwords via configd streamer log. This issue affects all versions of Junos OS Evolved prior to 19.3R1.
- 8.6CVE-2020-3175EPSS 2.0%
A vulnerability in the resource handling system of Cisco NX-OS Software for Cisco MDS 9000 Series Multilayer Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The v…
- 5.9CVE-2019-16779EPSS 1.7%
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returni…
- 8.8CVE-2019-5816EPSS 1.6%
Process lifetime issue in Chrome in Google Chrome on Android prior to 74.0.3729.108 allowed a remote attacker to potentially persist an exploited process via a crafted HTML page.
- 7.8CVE-2016-8763EPSS 0.8%
The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software VNS-L21C185B130 and earlier versions and P8 Lite with software ALE-L02C636B150 and earlier versions has an improper reso…