CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection')
variantUsing realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (25)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-20349US | —OT kritisch | KEV | ||
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software co… | ||||
| CVE-2025-1722US | high7.5 | — | ||
IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. | ||||
| CVE-2025-1719US | high7.5 | — | ||
IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. | ||||
| CVE-2025-1721US | high7.5 | — | ||
IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. | ||||
| CVE-2025-1761US | high7.5 | — | ||
IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. | ||||
| CVE-2025-1759US | high7.5 | — | ||
IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. | ||||
| CVE-2022-20922US | medium6.5 | — | ||
Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products could allow an unauthenticated, remote atta… | ||||
| CVE-2022-20943US | medium5.8 | — | ||
Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products could allow an unauthenticated, remote atta… | ||||
| CVE-2025-36083US | medium5.5 | — | ||
IBM Concert Software
1.0.0 through 2.0.0 could allow a local user to obtain sensitive information from buffers due to improper clearing of heap memory before release. | ||||
| CVE-2025-33013US | medium5.5 | — | ||
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Conta… | ||||
| CVE-2023-20031US | medium5.4 | — | ||
A vulnerability in the SSL/TLS certificate handling of Snort 3 Detection Engine integration with Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remot… | ||||
| CVE-2016-10011US | medium5.5 | — | ||
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key informa… | ||||
| CVE-2026-1510US | medium4.7 | — | ||
IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection. | ||||
| CVE-2023-20070US | medium4.0 | — | ||
A vulnerability in the TLS 1.3 implementation of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection en… | ||||
| CVE-2023-20177US | medium4.0 | — | ||
A vulnerability in the SSL file policy implementation of Cisco Firepower Threat Defense (FTD) Software that occurs when the SSL/TLS connection is configured with a URL Category and… | ||||
| CVE-2014-4021US | low2.7 | — | ||
Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors. | ||||
| CVE-2026-48025US | — | — | ||
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the pla… | ||||
| CVE-2025-70873US | — | — | ||
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted… | ||||
| CVE-2026-20039US | — | — | ||
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an una… | ||||
| CVE-2025-33101US | — | — | ||
IBM Concert 1.0.0 through 2.1.0 could allow an attacker to obtain sensitive information using man in the middle techniques due to improper clearing of heap memory. | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan