Weaknesses of type CWE-248

379 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-27819HIGHVikunja has Path Traversal in CLI RestoreEPSS 0.8%CVE-2026-88099MEDIUMWindows Failover Cluster Denial of Service VulnerabilityEPSS 0.8%CVE-2025-23166HIGHThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background tEPSS 0.8%CVE-2025-47944HIGHMulter vulnerable to Denial of Service from maliciously crafted requestsEPSS 0.8%CVE-2025-7338HIGHMulter vulnerable to Denial of Service via unhandled exception from malformed requestEPSS 0.8%CVE-2020-14348—It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the user namespace puts AMEPSS 0.8%CVE-2025-20171HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%CVE-2023-4785HIGHDenial of Service in gRPC CoreEPSS 0.8%CVE-2025-20172HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, EPSS 0.8%CVE-2025-20173HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%CVE-2025-20176HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%CVE-2024-23325HIGHEnvoy crashes when using an address type that isn’t supported by the OSEPSS 0.8%CVE-2023-23932MEDIUMSpecially crafted RTPS message may cause an OpenDDS application to crashEPSS 0.7%CVE-2024-31217MEDIUM@strapi/plugin-upload has a Denial-of-Service via Improper Exception HandlingEPSS 0.7%CVE-2024-11738MEDIUMRustls: rustls network-reachable panic in `acceptor::accept`EPSS 0.7%CVE-2023-0158HIGHTriggered crash on direct RRDP accessEPSS 0.7%CVE-2022-38166HIGHIn F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler cEPSS 0.7%CVE-2023-0790HIGHUncaught Exception in thorsten/phpmyfaqEPSS 0.7%CVE-2026-64612HIGHLibcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed pngEPSS 0.7%CVE-2023-27318MEDIUMDenial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) EPSS 0.7%