Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query due to improper release of memory resources.

CVE-2025-36071 is a vulnerability identified in IBM Db2 for Linux, UNIX, and Windows platforms, including DB2 Connect Server, affecting versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.2. The vulnerability is classified under CWE-772, which pertains to the missing release of resources after their effective lifetime. Specifically, this flaw arises from improper memory resource management within the Db2 server when processing certain specially crafted queries. An attacker with the ability to submit queries with limited privileges (as indicated by the CVSS vector requiring low privileges but no user interaction) can exploit this vulnerability to cause a denial of service (DoS) condition by triggering a server crash. The root cause is the failure to correctly release allocated memory resources, leading to resource exhaustion or instability that ultimately results in the server becoming unresponsive or crashing. The vulnerability does not impact confidentiality or integrity but severely affects availability. The CVSS score of 6.5 (medium severity) reflects the moderate risk posed by this issue, given the ease of network exploitation and the requirement for some level of privileges but no user interaction. No known exploits are currently reported in the wild, and no patches are linked yet, indicating that remediation may still be pending or in progress. Organizations using affected IBM Db2 versions should consider this vulnerability a significant availability risk, especially in environments where database uptime is critical.

Detailed information about CVE-2025-36071: CWE-772 Missing Release of Resource after Effective Lifetime in IBM IBM Db2 affecting IBM IBM Db2. Get real-time upda

CVE-2025-36071: CWE-772 Missing Release of Resource after Effective Lifetime in IBM IBM Db2 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-36071: CWE-772 Missing Release of Resource after Effective Lifetime in IBM IBM Db2

Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial of service when 125 kHz Card Technology is enabled.

This issue affects T-Series Readers: 9.20 prior to vCR9.20.250213a (distributed in 9.20.1827 (MR2)), 9.10 prior to vCR9.10.250213a (distributed in 9.10.2692(MR5)), 9.00 prior to vCR9.00.250619a (distributed in  vEL9.00.3371 (MR7)),  all versions of 8.90 and prior.

CVE-2025-44003 is a medium-severity vulnerability identified in Gallagher T-Series Readers, specifically affecting versions prior to vCR9.20.250213a, vCR9.10.250213a, and vCR9.00.250619a, as well as all versions of 8.90 and earlier. The vulnerability is classified under CWE-772, which pertains to the missing release of a resource after its effective lifetime. In this context, the resource in question is related to the 125 kHz card technology functionality within the reader. The flaw allows an attacker with physical access to the reader to trigger a limited denial of service (DoS) condition. This occurs because the reader fails to properly release resources after their intended use, leading to resource exhaustion or lock-up states that degrade the device's availability. The attack vector requires physical proximity or access, as remote exploitation is not indicated. No authentication or user interaction is necessary beyond physical access. The CVSS v3.1 score is 4.3, reflecting a low attack vector (adjacent network), low complexity, no privileges required, no user interaction, and impact limited to availability only. There are no known exploits in the wild, and no official patches have been linked yet. This vulnerability could disrupt access control systems relying on these readers, potentially causing operational interruptions in facilities using Gallagher T-Series Readers with 125 kHz card technology enabled.

Detailed information about CVE-2025-44003: CWE-772 Missing Release of Resource after Effective Lifetime in Gallagher T-Series Readers affecting Gallagher T-Seri

CVE-2025-44003: CWE-772 Missing Release of Resource after Effective Lifetime in Gallagher T-Series Readers - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-44003: CWE-772 Missing Release of Resource after Effective Lifetime in Gallagher T-Series Readers

In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause data to be incorrectly written to and read from invalid locations as well as returning incorrect cryptographic data.

CVE-2025-0036 is a vulnerability identified in AMD's Platform Loader and Manager (PLM) component, specifically affecting AMD Versal Adaptive SoC devices. The core issue involves an incorrect calculation or configuration of the Secure Subsystem (SSS) during runtime cryptographic operations, which occur after the system boot phase. This misconfiguration can lead to data being written to and read from invalid memory locations, resulting in the return of incorrect cryptographic data. The vulnerability is categorized under several CWE identifiers, including CWE-682 (Incorrect Calculation), CWE-772 (Missing Release of Resource after Effective Lifetime), CWE-940 (Improper Initialization), CWE-941 (Improper Handling of Exceptional Conditions), and CWE-497 (Exposure of Sensitive Information to an Unauthorized Actor). These classifications suggest that the vulnerability stems from flawed logic in cryptographic processing and resource management within the PLM. The CVSS v3.1 base score is 3.2, indicating a low severity level. The vector string (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) reveals that exploitation requires local access with low privileges, some user interaction, and results in a confidentiality impact with scope change but no integrity or availability impact. No known exploits are currently reported in the wild, and no patches are linked yet, though affected versions are referenced in AMD-SB-8011. The vulnerability could cause cryptographic operations to produce incorrect outputs, potentially undermining the security guarantees of cryptographic functions, which may affect secure communications, data protection, or authentication mechanisms relying on the PLM's cryptographic services.

Detailed information about CVE-2025-0036: CWE-682 Incorrect Calculation in AMD Platform Loader and Manager (PLM) affecting AMD Platform Loader and Manager (PLM)

CVE-2025-0036: CWE-682 Incorrect Calculation in AMD Platform Loader and Manager (PLM) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-0036: CWE-682 Incorrect Calculation in AMD Platform Loader and Manager (PLM)

Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library.
Fix for this issue has been included in 1.24.0 release.

CVE-2025-3864 is a vulnerability identified in the hackney HTTP client library, specifically related to improper resource management when handling HTTP 307 Temporary Redirect responses. Hackney fails to correctly release HTTP connections back to the connection pool after processing such redirects. This flaw is categorized under CWE-772, which pertains to missing release of resources after their effective lifetime. The consequence of this issue is that an attacker can remotely exploit the vulnerability by repeatedly triggering 307 redirects, causing the connection pool to become exhausted. When the pool is depleted, legitimate application requests cannot obtain connections, resulting in a denial of service (DoS) condition. The vulnerability affects all versions prior to the 1.24.0 release, where the fix has been implemented. The CVSS 4.0 base score is 2.3, indicating a low severity primarily due to the lack of confidentiality, integrity, or availability impact beyond resource exhaustion, the requirement for user interaction, and the absence of authentication requirements. The attack vector is network-based, and the attack complexity is low, but the impact is limited to availability degradation through resource exhaustion rather than direct data compromise or system takeover. No known exploits are currently reported in the wild. This vulnerability is significant for applications relying on hackney for HTTP client functionality, especially those that handle redirects frequently or operate under high load conditions where connection pool exhaustion can severely degrade service availability.

Detailed information about CVE-2025-3864: CWE-772 Missing Release of Resource after Effective Lifetime in hackney hackney affecting hackney hackney. Get real-ti

CVE-2025-3864: CWE-772 Missing Release of Resource after Effective Lifetime in hackney hackney - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-3864: CWE-772 Missing Release of Resource after Effective Lifetime in hackney hackney

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.

CVE-2022-45887 is a medium-severity vulnerability identified in the Linux kernel versions up to 6.0.9, specifically within the USB driver for the ttusb-dec device (drivers/media/usb/ttusb-dec/ttusb_dec.c). The issue arises due to a memory leak caused by the absence of a call to dvb_frontend_detach, which is responsible for properly releasing resources associated with the DVB frontend device. This memory leak can lead to resource exhaustion over time if the affected driver is repeatedly initialized and torn down without proper cleanup. The vulnerability is categorized under CWE-362 (Race Condition) and CWE-772 (Missing Release of Resource after Effective Lifetime), indicating that improper resource management and potential concurrency issues contribute to the problem. The CVSS v3.1 score is 4.7 (medium), with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, meaning the attack requires local access with low privileges, high attack complexity, no user interaction, and impacts availability only. No known exploits are currently reported in the wild, and no official patches are linked in the provided data, though it is likely that kernel maintainers have addressed or will address this issue in subsequent releases. The vulnerability does not affect confidentiality or integrity but can degrade system availability through memory exhaustion, potentially causing denial of service on affected systems using the ttusb-dec USB device driver.

Detailed information about CVE-2022-45887: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2022-45887: n/a in n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-45887: n/a in n/a

Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, which allows remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data, aka the "Named Pipes Over RPC" vulnerability.

CVE-1999-1127 is a vulnerability affecting Microsoft Windows NT 4.0, specifically related to the handling of named pipe RPC (Remote Procedure Call) connections. The issue arises because Windows NT 4.0 does not properly terminate invalid named pipe RPC connections. Attackers can exploit this flaw by sending a series of malformed connection requests to the targeted system's named pipes. These malformed requests cause the system to allocate resources without properly releasing them, leading to resource exhaustion. This results in a denial of service (DoS) condition, where legitimate users and processes are unable to access necessary services due to depleted system resources. The vulnerability is categorized under CWE-772 (Missing Release of Resource after Effective Lifetime), highlighting improper resource management. The CVSS v3.1 base score for this vulnerability is 7.5, indicating a high severity level. The attack vector is network-based (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and impacts availability only (A:H) without affecting confidentiality or integrity. Although this vulnerability dates back to 1999 and affects an outdated operating system, Windows NT 4.0, it remains relevant in legacy environments where such systems may still be operational. Microsoft has issued patches addressing this vulnerability (MS98-017), and no known exploits have been reported in the wild to date.

NVD CVE Feed

Detailed information about CVE-1999-1127: Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, which allows remote a affecting microso

CVE-1999-1127: Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, which allows remote a - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'cwe-772'

Filter Threats

Threats Tagged 'cwe-772'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility