Weaknesses of type CWE-248

291 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-33191HIGHfree5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server ErrorEPSS 0.4%CVE-2026-82254HIGHgitoxide before 0.69.0 Denial of Service via gix-packEPSS 0.4%CVE-2026-9509HIGHUncaught exception vulnerability in Suprema's BioStarEPSS 0.4%CVE-2026-37554HIGHAn issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists EPSS 0.4%CVE-2023-5310MEDIUMZ-Wave Denial of Service caused by Stream of PacketsEPSS 0.3%CVE-2026-92954CRITICALvm2 3.10.0 through 3.11.5 Denial of Service via Host PromiseEPSS 0.3%CVE-2026-45554MEDIUMNiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routesEPSS 0.3%CVE-2026-55484HIGHALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire serverEPSS 0.3%CVE-2024-52903MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2022-51009HIGHPocketMine-MP before 4.7.2 Denial of Service via Skin GeometryEPSS 0.3%CVE-2026-46545HIGHnimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed itemEPSS 0.3%CVE-2023-52342HIGHIn modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosuEPSS 0.3%CVE-2026-61666HIGHwebsocket-driver: Denial of service via malformed Host headerEPSS 0.3%CVE-2025-0657HIGHALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-rangeEPSS 0.3%CVE-2026-54553MEDIUMStarlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoSEPSS 0.3%CVE-2026-52856HIGHWings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceEPSS 0.3%CVE-2023-25526MEDIUMNVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exceEPSS 0.3%CVE-2026-34943MEDIUMWasmtime panics when lifting `flags` component valueEPSS 0.3%CVE-2026-42544HIGHGranian: Unauthenticated DoS via WebSocket subprotocol header panicEPSS 0.3%CVE-2024-49705MEDIUMXSS in iKSORISEPSS 0.3%