Weaknesses of type CWE-248

381 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-121386HIGHFreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image ReadersEPSS 0.3%CVE-2019-10917—A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.EPSS 0.3%CVE-2022-3500MEDIUMA vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exEPSS 0.3%CVE-2026-110854HIGHParse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email ErrorEPSS 0.3%CVE-2026-79833HIGHHPE NonStop ANSI SQLUTIL - Denial of Service vulnerabilityEPSS 0.3%CVE-2026-87029MEDIUMundici vulnerable to Denial of Service via unhandled exception in the decompress interceptorEPSS 0.3%CVE-2026-41585MEDIUMZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated ClientsEPSS 0.3%CVE-2026-89315MEDIUMJwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffixEPSS 0.3%CVE-2023-6533MEDIUMSilicon Labs PC Controller Denial of Service VulnerabilityEPSS 0.3%CVE-2026-89318MEDIUMJweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)EPSS 0.2%CVE-2026-78243LOWApache YuniKorn: LDAP Group provider panics on lowercase attribute nameEPSS 0.2%CVE-2025-24836MEDIUMQardio Heart Health IOS and Android Application and QardioARM A100 Uncaught ExceptionEPSS 0.2%CVE-2022-1975—There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-EPSS 0.2%CVE-2026-107214HIGHExcelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooksEPSS 0.2%CVE-2025-13064MEDIUMA server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by EPSS 0.2%CVE-2025-66578MEDIUMrobrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validationEPSS 0.2%CVE-2026-34944MEDIUMWasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64EPSS 0.2%CVE-2026-107382MEDIUMMariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLSEPSS 0.2%CVE-2023-22292HIGHUncaught exception for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local acEPSS 0.2%CVE-2024-13417MEDIUMSpecifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully wEPSS 0.2%