CWE-459 Incomplete Cleanup
baseThe product does not properly "clean up" and remove temporary or supporting resources after they have been used.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (310)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-17090US | high7.5 | Exploit | ||
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 and older. If the cha… | ||||
| CVE-2025-31650US | high7.5 | Exploit | ||
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request whic… | ||||
| CVE-2021-39327US | medium5.3 | Exploit | ||
The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which… | ||||
| CVE-2018-18924US | high8.8 | Exploit | ||
The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file with "#exec cmd" because rejected files remain on the serve… | ||||
| CVE-2022-1552US | high8.8OT elevated | — | ||
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, C… | ||||
| CVE-2020-0183US | high7.8 | Exploit | ||
In handleMessage of BluetoothManagerService, there is an incomplete reset. This could lead to local escalation of privilege with no additional execution privileges needed. User int… | ||||
| CVE-2026-3304US | high7.5 | Exploit | ||
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sendi… | ||||
| CVE-2021-45330US | critical9.8 | — | ||
An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server s… | ||||
| CVE-2020-13451US | critical9.8 | — | ||
An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary… | ||||
| CVE-2005-1744US | critical9.8 | — | ||
BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the app… | ||||
| CVE-2022-45347US | critical9.8 | — | ||
Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an… | ||||
| CVE-2021-36205US | critical9.8 | — | ||
Under certain circumstances the session token is not cleared on logout. | ||||
| CVE-2021-45706US | critical9.8 | — | ||
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum. | ||||
| CVE-2021-32928US | critical9.8 | — | ||
The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows incoming connections from private network… | ||||
| CVE-2025-21609US | critical9.1 | — | ||
SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the… | ||||
| CVE-2023-36468US | high8.8 | — | ||
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for… | ||||
| CVE-2021-37315US | critical9.1 | — | ||
Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improp… | ||||
| CVE-2019-25016US | high8.8 | — | ||
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules… | ||||
| CVE-2019-18191US | high8.8 | — | ||
A privilege escalation vulnerability in the Trend Micro Deep Security as a Service Quick Setup cloud formation template could allow an authenticated entity with certain unrestricte… | ||||
| CVE-2020-24489US | high8.8 | — | ||
Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access. | ||||
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan