Weaknesses of type CWE-248

379 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2020-10292HIGHService DoS through arbitrary pointer dereferencing on KUKA simulatorEPSS 1.5%CVE-2022-31015MEDIUMUncaught Exception (due to a data race) leads to process termination in WaitressEPSS 1.5%CVE-2026-70082HIGHWindows DNS Denial of Service VulnerabilityEPSS 1.3%CVE-2023-31125MEDIUMUncaught exception in engine.ioEPSS 1.3%CVE-2020-5129—A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which leaEPSS 1.3%CVE-2022-20675MEDIUMMultiple Cisco Security Products Simple Network Management Protocol Service Denial of Service VulnerabilityEPSS 1.3%CVE-2024-20137HIGHIn wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions. This could lead to remote deniaEPSS 1.3%CVE-2023-3966HIGHOpenvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packetEPSS 1.3%CVE-2026-50328HIGHWindows Server Update Service (WSUS) Tampering VulnerabilityEPSS 1.2%CVE-2022-20919HIGHCisco IOS and IOS XE Software Common Industrial Protocol Request Denial of Service VulnerabilityEPSS 1.2%CVE-2022-36046MEDIUMUnexpected server crash in Next.js version 12.2.3EPSS 1.2%CVE-2020-27121MEDIUMCisco Unified Communications Manager IM and Presence Service Denial of Service VulnerabilityEPSS 1.2%CVE-2026-69839MEDIUMWindows iSCSI Target Service Denial of Service VulnerabilityEPSS 1.1%CVE-2019-6830—A CWE-248: Uncaught Exception vulnerability exists IN Modicon M580 all versions prior to V2.80, which could cause a possible denial of serviEPSS 1.1%CVE-2023-2251HIGHUncaught Exception in eemeli/yamlEPSS 1.1%CVE-2023-22477MEDIUMMercurius is vulnerable to denial of service (DoS) when using subscriptionsEPSS 1.1%CVE-2021-33010HIGHAVEVA System Platform Uncaught ExceptionEPSS 1.1%CVE-2026-96945HIGHWindows Failover Cluster Denial of Service VulnerabilityEPSS 1.1%CVE-2023-39948HIGHUncaught fastcdr exception (Unexpected CDR type received) crashing fastddsEPSS 1.0%CVE-2026-92905MEDIUMDenial of Service VulnerabilityEPSS 1.0%