Weaknesses of type CWE-248

379 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-59892HIGHOpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed headerEPSS 0.6%CVE-2025-35436MEDIUMCISA Thorium account verification email error handlingEPSS 0.6%CVE-2025-47281HIGHKyverno's Improper JMESPath Variable Evaluation Leads to Denial of ServiceEPSS 0.6%CVE-2025-71391HIGHSurrealDB before 2.2.2 Denial of Service via /sql endpointEPSS 0.6%CVE-2025-20664HIGHIn wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) inEPSS 0.5%CVE-2025-20663HIGHIn wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) inEPSS 0.5%CVE-2025-59462MEDIUMDenial-of-service (DoS) via delayed or missing client responseEPSS 0.5%CVE-2025-20758MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.5%CVE-2026-54908MEDIUMPion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange messageEPSS 0.5%CVE-2026-42270HIGHcountly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream ExceptionEPSS 0.5%CVE-2025-0648MEDIUMM-Files Server crash via EOT database driver configurationEPSS 0.5%CVE-2026-52731MEDIUMZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplateEPSS 0.5%CVE-2022-51014HIGHPocketMine-MP before 4.0.7 Denial of Service via JSON DecodingEPSS 0.5%CVE-2025-20753MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.5%CVE-2025-20754MEDIUMIn Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connecEPSS 0.5%CVE-2026-33203HIGHSiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive BypassEPSS 0.5%CVE-2023-29520MEDIUMPage render failure due to broken translations in xwiki-platformEPSS 0.5%CVE-2026-84994HIGHQwik: Crashing any Qwik Server via Resource thenableEPSS 0.5%CVE-2026-48038MEDIUMjoi: Uncaught RangeError on deeply nested input through recursive `link()` schemasEPSS 0.5%CVE-2026-72660MEDIUMUncaught Exception in Kibana Leading to Denial of ServiceEPSS 0.5%