Weaknesses of type CWE-248

381 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2021-3038MEDIUMGlobalProtect App: Windows VPN kernel driver denial of service (DoS)EPSS 0.2%CVE-2023-23774HIGHMotorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt onEPSS 0.2%CVE-2026-89316MEDIUMLoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertionEPSS 0.2%CVE-2026-44905HIGHVanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic VerificationEPSS 0.2%CVE-2021-33145HIGHUncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged usEPSS 0.2%CVE-2026-84947LOWundici vulnerable to response truncation via oversized chunked responses in the dump interceptorEPSS 0.2%CVE-2025-20054MEDIUMUncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable deniaEPSS 0.2%CVE-2026-87018HIGHundici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationEPSS 0.2%CVE-2026-43988HIGHVanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER ParsingEPSS 0.2%CVE-2026-102511HIGHApache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from themEPSS 0.2%CVE-2024-29076MEDIUMUncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of sEPSS 0.2%CVE-2025-8870MEDIUMOn affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.EPSS 0.2%CVE-2026-55244MEDIUMASTEVAL: Sandbox Escape via BaseException SubclassesEPSS 0.2%CVE-2024-32995MEDIUMDenial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.2%CVE-2026-45676MEDIUMOpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agentEPSS 0.2%CVE-2026-101175MEDIUMNull pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.2%CVE-2026-96274HIGHUncaught exception in Baicells Nova 430HEPSS 0.2%CVE-2026-12067—AvastSvc denial of service via unhandled JsonCpp exceptions in native message handlersEPSS 0.2%CVE-2026-80303—Avast WFP stream parser integer underflow causes system crashEPSS 0.2%CVE-2024-33848MEDIUMUncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of servicEPSS 0.1%