Weaknesses of type CWE-390

19 results

Detecção de erro sem tratamento

O código verifica se um erro ocorreu, mas não faz nada a respeito — simplesmente ignora ou continua a execução. Isso permite que operações falhem silenciosamente, deixando o programa em estado inconsistente ou processando dados inválidos sem o operador saber.

Example

Um aplicativo tenta abrir um arquivo de configuração, verifica se houve erro na abertura, mas segue adiante usando valores padrão incorretos ou parcialmente lidos. Um atacante pode forçar a falha da leitura e explorar o comportamento degradado para contornar validações de segurança.

How to mitigate

Sempre implemente ação explícita após detectar erro: lance exceção, registre em log, falhe seguro ou notifique o operador. Não deixe código dormindo após validação — teste e documente o que deve acontecer em cada cenário de falha.

CVE-2024-30255MEDIUMHTTP/2: CPU exhaustion due to CONTINUATION frame floodEPSS 87.8%CVE-2024-27919HIGHHTTP/2: memory exhaustion due to CONTINUATION frame floodEPSS 86.7%CVE-2025-26465MEDIUMOpenssh: machine-in-the-middle attack if verifyhostkeydns is enabledEPSS 7.4%CVE-2019-5051HIGHAn exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handlerEPSS 4.0%CVE-2021-40391CRITICALAn out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and EPSS 2.9%CVE-2017-7485—In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL envirEPSS 2.0%CVE-2024-12086MEDIUMRsync: rsync server leaks arbitrary client filesEPSS 1.8%CVE-2026-53434CRITICALApache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM ConnectorEPSS 0.5%CVE-2024-20316MEDIUMA vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to accesEPSS 0.5%CVE-2025-25204MEDIUM`gh attestation verify` returns incorrect exit code during verification if no attestations are presentEPSS 0.4%CVE-2024-11942MEDIUMDrupal core - Moderately critical - Improper error handling - SA-CORE-2024-002EPSS 0.4%CVE-2026-52989CRITICALnvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callersEPSS 0.3%CVE-2025-46367HIGHDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. EPSS 0.1%CVE-2026-48792MEDIUMpam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root executionEPSS 0.1%CVE-2025-0029LOWImproper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writeEPSS 0.1%CVE-2026-44310MEDIUMgitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callersEPSS 0.1%CVE-2026-59845MEDIUMLibssh: libssh: denial of service via unchecked proxycommand fork() failureEPSS 0.1%CVE-2024-49841HIGHDetection of Error Condition Without Action in HypervisorEPSS 0.1%CVE-2025-27039MEDIUMDetection of Error Condition Without Action in Computer VisionEPSS 0.1%