Weaknesses of type CWE-248

291 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-42545MEDIUMGranian: DoS via WSGI response header panicEPSS 0.2%CVE-2024-13417MEDIUMSpecifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully wEPSS 0.2%CVE-2021-3038MEDIUMGlobalProtect App: Windows VPN kernel driver denial of service (DoS)EPSS 0.2%CVE-2023-23774HIGHMotorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt onEPSS 0.2%CVE-2026-49096MEDIUMUncaught Exception in Kibana Cases Leading to Denial of ServiceEPSS 0.2%CVE-2026-44905HIGHVanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic VerificationEPSS 0.2%CVE-2026-84947LOWundici vulnerable to response truncation via oversized chunked responses in the dump interceptorEPSS 0.2%CVE-2021-33145HIGHUncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged usEPSS 0.2%CVE-2026-55244MEDIUMASTEVAL: Sandbox Escape via BaseException SubclassesEPSS 0.2%CVE-2026-43988HIGHVanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER ParsingEPSS 0.2%CVE-2024-29076MEDIUMUncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of sEPSS 0.2%CVE-2025-20054MEDIUMUncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable deniaEPSS 0.2%CVE-2025-8870MEDIUMOn affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.EPSS 0.2%CVE-2024-32995MEDIUMDenial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.2%CVE-2026-45676MEDIUMOpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agentEPSS 0.2%CVE-2024-33848MEDIUMUncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of servicEPSS 0.1%CVE-2025-0158MEDIUMIBM EntireX denial of serviceEPSS 0.1%CVE-2026-35348MEDIUMuutils coreutils sort Local Denial of Service via Forced UTF-8 ParsingEPSS 0.1%CVE-2025-15649MEDIUMIO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS dateEPSS 0.1%CVE-2024-42037CRITICALVulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confideEPSS 0.1%