Weaknesses of type CWE-248

291 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2023-6640MEDIUMSilicon Labs PC Controller v5.54.0 and Earlier Denial of Service VulnerabilityEPSS 0.3%CVE-2026-65834MEDIUMCapsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requestsEPSS 0.3%CVE-2019-10917—A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.EPSS 0.3%CVE-2026-81517HIGHMongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL ServiceEPSS 0.3%CVE-2026-47219HIGHfind-my-way is Vulnerable to DDoS with HTTP2EPSS 0.3%CVE-2022-3500MEDIUMA vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exEPSS 0.3%CVE-2026-82417MEDIUMqs.stringify throws TypeError on objects with a non-callable constructor.isBuffer propertyEPSS 0.3%CVE-2026-41585MEDIUMZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated ClientsEPSS 0.3%CVE-2026-27631LOWExiv2: Uncaught exception - cannot create std::vector larger than max_size()EPSS 0.3%CVE-2026-85024MEDIUMundici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionEPSS 0.3%CVE-2026-87123MEDIUMhbs vulnerable to Denial of Service via unhandled exception in async helper output escapingEPSS 0.3%CVE-2023-6533MEDIUMSilicon Labs PC Controller Denial of Service VulnerabilityEPSS 0.3%CVE-2025-24836MEDIUMQardio Heart Health IOS and Android Application and QardioARM A100 Uncaught ExceptionEPSS 0.2%CVE-2025-66578MEDIUMrobrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validationEPSS 0.2%CVE-2022-1975—There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-EPSS 0.2%CVE-2025-13064MEDIUMA server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by EPSS 0.2%CVE-2026-79778MEDIUMrclone before v1.75.0 Denial of Service via TUS nil-response panicEPSS 0.2%CVE-2026-61544HIGHlibp2p-quic: Remote panic via certificate expiry race during QUIC handshakeEPSS 0.2%CVE-2026-34944MEDIUMWasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64EPSS 0.2%CVE-2023-22292HIGHUncaught exception for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local acEPSS 0.2%