CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
Also known as Insufficient Cleanup.
A kind of CWE-404 Improper Resource Shutdown or Release.
From the CWE List. © The MITRE Corporation.
Newest
- zcashfoundation zebra Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body 8.7 High
- nvm-sh nvm nvm install --offline installs a cached tarball that previously failed checksum verification 2.1 Low
- google chrome Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker... 8.8 High
- google chrome Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker... No score
- google chrome Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read... No score
- zephyrproject zephyr Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer 4.6 Medium
-
libhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 more HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk 7.1 High - the-40-thieves obsidian-tc obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes 7.1 High
- google chrome Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker... 8.8 High
- google chrome Out of bounds read in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 6.5 Medium
- google chrome Use after free in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 8.8 High
- google chrome Out of bounds read in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote... 6.5 Medium
- google chrome Improper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote... 8.8 High
- apostrophecms apostrophe ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory 7.5 High
- apache software foundation tomcat Apache Tomcat: Possible TLS 1.3 connection failures 7.5 High
- apache software foundation tomcat Apache Tomcat: HTTP/2 trailer header cross-contamination 7.5 High
- @fastify/oauth2 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback 4.2 Medium
- misp MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records 5.1 Medium
- nodejs undici undici vulnerable to Denial of Service via unhandled error on excessive content-encodings 7.5 High
- abb my control system My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion 5.1 Medium
- juniper networks junos os, junos os evolved +1 more Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used 8.7 High
- misskey-dev misskey Misskey: Denial of service resulting from insufficient cleanup processing during file uploads 8.7 High
- codefori vscode-ibmi Code for IBM i: Temporary files are visible to all users 5.1 Medium
- imagemagick ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder 6.9 Medium
- idrix veracrypt VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data.... 7.2 High
- zephyrproject zephyr Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure 6.5 Medium
- zephyrproject zephyr Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update 6.5 Medium
- backdropcms backdrop Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration... 7.8 High
- aws aws-toolkit-vscode Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code 6.8 Medium
- google chrome Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a... 9.1 Critical
- google chrome Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker... 4.3 Medium
- google chrome Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to... 9.6 Critical
- google chrome Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote... 4.2 Medium
- google chrome Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote... 8.8 High
- google chrome Incomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent... 5.3 Medium
- google chrome Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a... 5.4 Medium
- zcashfoundation zebra Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry 8.2 High
- zcashfoundation zebra Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout 6.9 Medium
- denx software engineering das u-boot Out-of-bounds write in Das U-Boot 9.0 Critical
- ag-ui-protocol ag-ui ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup 5.3 Medium
- google chrome Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker... 8.4 High
- google chrome Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker... 6.5 Medium
- apache software foundation tomcat Apache Tomcat: HTTP/2 DoS via malformed request 7.3 High
- google chrome Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote... 3.1 Low
- arista networks eos A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued. 2.1 Low
- arista networks eos A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants,… 5.6 Medium
- arista networks eos A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window… 2.1 Low
- expressjs multer multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads 5.3 Medium
- compression compression vulnerable to Denial of Service via memory leak on premature response close 7.5 High
- google chrome Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker... 6.5 Medium
- Show olderLoading…