Weaknesses of type CWE-248

381 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2025-0158MEDIUMIBM EntireX denial of serviceEPSS 0.1%CVE-2026-35348MEDIUMuutils coreutils sort Local Denial of Service via Forced UTF-8 ParsingEPSS 0.1%CVE-2025-24851MEDIUMUncaught exception in the firmware for some 100GbE Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare MetalEPSS 0.1%CVE-2026-102413MEDIUMUncaught Exception in Elastic Endpoint Leading to Denial of ServiceEPSS 0.1%CVE-2025-15649MEDIUMIO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS dateEPSS 0.1%CVE-2025-48430MEDIUMUncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server atEPSS 0.1%CVE-2026-20775MEDIUMUncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a denial of service. System software adversary with aEPSS 0.1%CVE-2024-42037CRITICALVulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confideEPSS 0.1%CVE-2025-54777MEDIUMUncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it maEPSS 0.1%CVE-2025-48907MEDIUMDeserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2024-20048MEDIUMIn flashc, there is a possible information disclosure due to an uncaught exception. This could lead to local information disclosure with SysEPSS 0.1%CVE-2026-110933MEDIUMUncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before fb10a5c8b833EPSS 0.1%CVE-2026-5937MEDIUMFoxit PDF Editor/Reader's insufficient parameter validation leads to denial-of-service vulnerabilityEPSS 0.1%CVE-2024-20049MEDIUMIn flashc, there is a possible information disclosure due to an uncaught exception. This could lead to local information disclosure with SysEPSS 0.1%CVE-2023-20628MEDIUMIn thermal, there is a possible memory corruption due to an uncaught exception. This could lead to local escalation of privilege with SystemEPSS 0.1%CVE-2023-21087MEDIUMIn PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to local persistent deniaEPSS 0.1%CVE-2026-59004HIGHIn multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege EPSS 0.1%CVE-2026-55288HIGHIn validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. This could lead to locEPSS 0.1%CVE-2026-58859HIGHIn multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege wiEPSS 0.1%CVE-2026-123562HIGHDevalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled RejectionEPSS —