Weaknesses of type CWE-248

291 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2019-7474—A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloaEPSS 0.7%CVE-2023-22290MEDIUMUncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network accessEPSS 0.7%CVE-2024-58368HIGHSurrealDB before 1.1.0 Denial of Service via HTTP HeadersEPSS 0.7%CVE-2023-20086HIGHA vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software cEPSS 0.7%CVE-2026-34986HIGHGo JOSE affect by a panic in JWE decryptionEPSS 0.7%CVE-2025-20637HIGHIn network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional EPSS 0.6%CVE-2026-32641HIGHParseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middlewareEPSS 0.6%CVE-2024-8020HIGHDenial of Service in lightning-ai/pytorch-lightningEPSS 0.6%CVE-2023-42447HIGHblurhash panics on parsing crafted inputsEPSS 0.6%CVE-2026-48068HIGH@grpc/grps-js: A malformed request can cause a server crashEPSS 0.6%CVE-2026-33939HIGHHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationEPSS 0.6%CVE-2026-58208MEDIUMNATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is EnabledEPSS 0.6%CVE-2026-54775MEDIUMCoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.EPSS 0.6%CVE-2024-43367HIGHBoa has an uncaught exception when transitioning the state of `AsyncGenerator` objectsEPSS 0.6%CVE-2025-32944MEDIUMPeerTube User Import Authenticated Persistent Denial of ServiceEPSS 0.6%CVE-2026-77781HIGHTie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keysEPSS 0.6%CVE-2026-25128HIGHfast-xml-parser has RangeError DoS Numeric Entities BugEPSS 0.6%CVE-2026-82410HIGHPocketbase: Unhandled panic in worker goroutinesEPSS 0.6%CVE-2025-35436MEDIUMCISA Thorium account verification email error handlingEPSS 0.6%CVE-2026-32770MEDIUMParse Server: LiveQuery subscription with invalid regular expression crashes serverEPSS 0.5%