CWE-404— Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.— MITRE CWE catalog
731 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-404page 2 of 15
- CVE-2018-8406HIGHCVSS 7.8EG 9.0⚠ KEV2018-08-15
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Wi…
- CVE-2018-8410HIGHCVSS 7.8EG 7.82018-09-13
An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory, aka "Windows Registry Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows …
- CVE-2018-8450HIGHCVSS 8.8EG 8.82018-11-14
A remote code execution vulnerability exists when Windows Search handles objects in memory, aka "Windows Search Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Wind…
- CVE-2018-8453HIGHCVSS 7.8EG 9.0⚠ KEV2018-10-10
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8…
- CVE-2018-8455HIGHCVSS 7.8EG 7.82018-09-13
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 201…
- CVE-2018-8462HIGHCVSS 7.8EG 7.82018-09-13
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Wi…
- CVE-2018-8471HIGHCVSS 7.8EG 7.82018-11-14
An elevation of privilege vulnerability exists in the way that the Microsoft RemoteFX Virtual GPU miniport driver handles objects in memory, aka "Microsoft RemoteFX Virtual GPU miniport driver Elevation of Privilege Vulnerability." This af…
- CVE-2018-8484HIGHCVSS 7.8EG 7.82018-10-10
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2,…
- CVE-2018-8485HIGHCVSS 7.8EG 7.82018-11-14
An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server …
- CVE-2018-8497HIGHCVSS 7.8EG 7.82018-10-10
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Wind…
- CVE-2018-8554HIGHCVSS 7.8EG 7.82018-11-14
An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019. This CVE ID is unique f…
- CVE-2018-8561HIGHCVSS 7.8EG 7.82018-11-14
An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server …
- CVE-2018-8562HIGHCVSS 7.8EG 7.82018-11-14
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8…
- CVE-2018-8611HIGHCVSS 7.8EG 9.0⚠ KEV2018-12-12
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, W…
- CVE-2018-8639HIGHCVSS 7.8EG 9.0⚠ KEV2018-12-12
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8…
- CVE-2018-8641HIGHCVSS 7.8EG 7.82018-12-12
An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Wi…
- CVE-2018-8836MEDIUMCVSS 5.3EG 5.32018-04-03
Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 way handshake during a TCP connection affecting the communications with commission and service tools.…
- CVE-2019-0019HIGHCVSS 7.5EG 7.52019-04-10
When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. Affected rel…
- CVE-2019-0028HIGHCVSS 7.5EG 7.52019-04-10
On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the local routing protocol d…
- CVE-2019-0042MEDIUMCVSS 4.2EG 4.22019-04-10
Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allow an attacker with physical access to an existing domain connected Windows syste…
- CVE-2019-0043HIGHCVSS 7.5EG 7.52019-04-10
In MPLS environments, receipt of a specific SNMP packet may cause the routing protocol daemon (RPD) process to crash and restart. By continuously sending a specially crafted SNMP packet, an attacker can repetitively crash the RPD process c…
- CVE-2019-0044HIGHCVSS 7.5EG 7.52019-04-10
Receipt of a specific packet on the out-of-band management interface fxp0 may cause the system to crash and restart (vmcore). By continuously sending a specially crafted packet to the fxp0 interface, an attacker can repetitively crash the …
- CVE-2019-0049HIGHCVSS 7.5EG 7.52019-07-11
On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a certain sequence of BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the loca…
- CVE-2019-0052HIGHCVSS 7.5EG 7.52019-07-11
The srxpfe process may crash on SRX Series services gateways when the UTM module processes a specific fragmented HTTP packet. The packet is misinterpreted as a regular TCP packet which causes the processor to crash. This issue affects all …
- CVE-2019-12625HIGHCVSS 7.5EG 7.52019-11-05
ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system.
- CVE-2019-15262HIGHCVSS 7.5EG 7.52019-10-16
A vulnerability in the Secure Shell (SSH) session management for Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerabi…
- CVE-2019-15302MEDIUMCVSS 6.5EG 6.52019-09-11
The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., cause data loss) via a trivial URL modification.
- CVE-2019-1705MEDIUMCVSS 5.3EG 5.92019-05-03
A vulnerability in the remote access VPN session manager of Cisco Adaptive Security Appliance (ASA) Software could allow a unauthenticated, remote attacker to cause a denial of service (DoS) condition on the remote access VPN services. The…
- CVE-2019-1706HIGHCVSS 8.6EG 8.62019-05-03
A vulnerability in the software cryptography module of the Cisco Adaptive Security Virtual Appliance (ASAv) and Firepower 2100 Series running Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker …
- CVE-2019-1708HIGHCVSS 8.6EG 8.62019-05-03
A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming Protocol (MOBIKE) feature for the Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthentic…
- CVE-2019-19331HIGHCVSS 7.5EG 7.52019-12-16
knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for eac…
- CVE-2019-19343HIGHCVSS 7.5EG 7.52021-03-23
A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. Versions before undertow…
- CVE-2019-19886HIGHCVSS 7.5EG 7.52020-01-21
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw in Transaction::addR…
- CVE-2019-20388HIGHCVSS 7.5EG 7.52020-01-21
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
- CVE-2019-25104LOWCVSS 3.5EG 7.52023-02-20
A vulnerability has been found in rtcwcoop 1.0.2 and classified as problematic. Affected by this vulnerability is the function AICast_ScriptLoad of the file code/game/ai_cast_script.c of the component Team Command Handler. The manipulation…
- CVE-2019-5603HIGHCVSS 7.8EG 7.82019-07-26
In FreeBSD 12.0-STABLE before r350261, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350263, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, system calls operating on file descriptors as part of mq…
- CVE-2019-5607HIGHCVSS 7.8EG 7.82019-07-26
In FreeBSD 12.0-STABLE before r350222, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350223, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, rights transmitted over a domain socket did not properly…
- CVE-2019-5636MEDIUMCVSS 5.3EG 5.32019-11-21
When a Beckhoff TwinCAT Runtime receives a malformed UDP packet, the ADS Discovery Service shuts down. Note that the TwinCAT devices are still performing as normal. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 vers…
- CVE-2019-6163MEDIUMCVSS 5.5EG 7.52019-06-26
A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standard locations.
- CVE-2019-6488HIGHCVSS 7.8EG 7.82019-01-18
The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead to a segmentation fault or possib…
- CVE-2020-0203HIGHCVSS 7.8EG 7.82020-06-11
In freeIsolatedUidLocked of ProcessList.java, there is a possible UID reuse due to improper cleanup. This could lead to local escalation of privilege between constrained processes with no additional execution privileges needed. User intera…
- CVE-2020-0414MEDIUMCVSS 6.5EG 6.52020-10-14
In AudioFlinger::RecordThread::threadLoop of audioflinger/Threads.cpp, there is a possible non-silenced audio buffer due to a permissions bypass. This could lead to remote information disclosure with no additional execution privileges need…
- CVE-2020-0467MEDIUMCVSS 5.5EG 5.52020-12-14
In onUserStopped of Vpn.java, there is a possible resetting of user preferences due to a logic issue. This could lead to local information disclosure of secure network traffic over a non-VPN link with no additional execution privileges nee…
- CVE-2020-0548MEDIUMCVSS 5.5EG 5.52020-01-28
Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
- CVE-2020-0549MEDIUMCVSS 5.5EG 5.52020-01-28
Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
- CVE-2020-10280HIGHCVSS 7.5EG 7.52020-06-24
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard.
- CVE-2020-12049MEDIUMCVSS 5.5EG 5.52020-06-08
An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus syst…
- CVE-2020-12439MEDIUMCVSS 5.3EG 5.32020-05-05
Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.
- CVE-2020-12758HIGHCVSS 7.5EG 7.52020-06-11
HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.
- CVE-2020-14307MEDIUMCVSS 6.5EG 6.52020-07-24
A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, …
Map vulnerabilities like CWE-404 to your infrastructure
EchelonGraph correlates every CVE — across CWE-404 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →