目标达成 感谢每一位支持者 — 我们达成了 100% 目标!

目标: 1000 元 · 已筹: 1359 元

100%

CWE-672 在过期或释放后对资源进行操作 类漏洞列表 47

CWE-672 在过期或释放后对资源进行操作 类弱点 47 条 CVE 漏洞汇总,含 AI 中文分析。

CWE-672属于资源使用后未正确释放或过期的漏洞。攻击者常利用此缺陷,在资源被回收或失效后继续访问,从而引发内存损坏、数据泄露或拒绝服务。开发者应避免在资源释放后引用其指针,确保在生命周期结束时彻底清理引用,并实施严格的访问控制与状态检查,防止对已过期资源的非法操作。

MITRE CWE 官方描述
CWE:CWE-672 在资源过期或释放后进行操作 英文:The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
常见影响 (2)
Integrity, Confidentiality Modify Application Data, Read Application Data
If a released resource is subsequently reused or reallocated, then an attempt to use the original resource might allow access to sensitive data that is associated with a different user or entity.
Other, Availability Other, DoS: Crash, Exit, or Restart
When a resource is released it might not be in an expected state, later attempts to access the resource may lead to resultant errors that may lead to a crash.
代码示例 (2)
The following code shows a simple example of a use after free error:
char* ptr = (char*)malloc (SIZE); if (err) { abrt = 1; free(ptr); } ... if (abrt) { logError("operation aborted before commit", ptr); }
Bad · C
The following code shows a simple example of a double free error:
char* ptr = (char*)malloc (SIZE); ... if (abrt) { free(ptr); } ... free(ptr);
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-93006 Dnsmasq TFTP 预取缓存堆指针错误致文件内容漏洞 — Red Hat Ceph Storage 9 6.8 Medium 2026-10-29
CVE-2026-96589 Gitea 私有仓库权限泄露漏洞 — Gitea - - 2026-10-06
CVE-2026-106345 Chrome<155.0.8059.39会话资源滥用导致UI spoof — Chrome - - 2026-10-06
CVE-2026-106310 Chrome <155.0.8059.39 FontAccess已释放资源使用后漏洞 — Chrome - - 2026-10-06
CVE-2026-106320 Chrome <155.0.8059.39 UI资源释放漏洞 — Chrome - - 2026-10-06
CVE-2026-106339 Chrome<155.0.8059.39跨域数据泄露漏洞 — Chrome - - 2026-10-06
CVE-2026-95366 Chrome 154前核心释放后重用致跨域 — Chrome - - 2026-09-29
CVE-2026-53637 Sylius 资源管理错误漏洞 — Sylius 6.5 Medium 2026-09-08
CVE-2026-85044 Google Chrome 资源管理错误漏洞 — Chrome - - 2026-09-03
CVE-2026-79010 Google Chrome 资源管理错误漏洞 — Chrome - - 2026-08-25
CVE-2026-68481 Apache CXF 在 DefaultEncryptingOAuthDataProvider 中的撤销绕过漏洞 — Apache CXF - - 2026-08-06
CVE-2026-42955 NLnet Labs Unbound 资源管理错误漏洞 — Unbound 3.7 Low 2026-07-22
CVE-2026-47087 cyrusimap Cyrus IMAP 资源管理错误漏洞 — Cyrus IMAP 3.5 Low 2026-07-16
CVE-2026-58291 Microsoft Edge 资源管理错误漏洞 — Microsoft Edge (Chromium-based) 6.1 Medium 2026-07-03
CVE-2026-56314 Capgo 资源管理错误漏洞 — Capgo 7.1 High 2026-06-22
CVE-2026-2379 Arista EOS 安全漏洞 — EOS 5.9 Medium 2026-06-05
CVE-2026-33463 Elastic Kibana 安全漏洞 — Kibana 5.3 Medium 2026-05-28
CVE-2026-4053 Mattermost 安全漏洞 — Mattermost 3.1 Low 2026-05-15
CVE-2026-45005 OpenClaw 安全漏洞 — OpenClaw 6.0 Medium 2026-05-11
CVE-2013-10075 Apache::Session::Generate::MD5 安全漏洞 — Apache::Session 5.3AI Medium AI 2026-05-08
CVE-2026-43585 OpenClaw 安全漏洞 — OpenClaw 8.1 High 2026-05-06
CVE-2026-1629 Mattermost 安全漏洞 — Mattermost 4.3 Medium 2026-03-16
CVE-2026-31875 Parse Server 安全漏洞 — parse-server 8.1AI High AI 2026-03-11
CVE-2026-1237 Juju 安全漏洞 — juju 8.8AI High AI 2026-01-28
CVE-2025-69415 Plex media server 安全漏洞 — Media Server 7.1 High 2026-01-02
CVE-2025-55669 F5 BIG-IP 安全漏洞 — BIG-IP 7.5 High 2025-10-15
CVE-2025-10060 MongoDB Server 安全漏洞 — MongoDB Server 6.5 Medium 2025-09-05
CVE-2025-53901 Bytecode Alliance Wasmtime 安全漏洞 — wasmtime 3.5 Low 2025-07-18
CVE-2025-6031 Amazon Cloud Cam 安全漏洞 — Cloud Cam 7.5 High 2025-06-12
CVE-2025-2517 OpenText ArcSight Enterprise Security Manager 安全漏洞 — ArcSight Enterprise Security Manager 9.8 - 2025-04-21

CWE-672(在过期或释放后对资源进行操作) 是常见的弱点类别,本平台收录该类弱点关联的 47 条 CVE 漏洞。