Weaknesses of type CWE-390

30 results

Detecção de erro sem tratamento

O código verifica se um erro ocorreu, mas não faz nada a respeito — simplesmente ignora ou continua a execução. Isso permite que operações falhem silenciosamente, deixando o programa em estado inconsistente ou processando dados inválidos sem o operador saber.

Example

Um aplicativo tenta abrir um arquivo de configuração, verifica se houve erro na abertura, mas segue adiante usando valores padrão incorretos ou parcialmente lidos. Um atacante pode forçar a falha da leitura e explorar o comportamento degradado para contornar validações de segurança.

How to mitigate

Sempre implemente ação explícita após detectar erro: lance exceção, registre em log, falhe seguro ou notifique o operador. Não deixe código dormindo após validação — teste e documente o que deve acontecer em cada cenário de falha.

CVE-2024-30255MEDIUMHTTP/2: CPU exhaustion due to CONTINUATION frame floodEPSS 85.0%CVE-2024-27919HIGHHTTP/2: memory exhaustion due to CONTINUATION frame floodEPSS 83.9%CVE-2025-26465MEDIUMOpenssh: machine-in-the-middle attack if verifyhostkeydns is enabledEPSS 7.7%CVE-2019-5051HIGHAn exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handlerEPSS 4.0%CVE-2021-40391CRITICALAn out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and EPSS 3.0%CVE-2017-7485—In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL envirEPSS 2.0%CVE-2024-12086MEDIUMRsync: rsync server leaks arbitrary client filesEPSS 1.8%CVE-2026-43493CRITICALcrypto: pcrypt - Fix handling of MAY_BACKLOG requestsEPSS 0.7%CVE-2026-53434CRITICALApache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM ConnectorEPSS 0.6%CVE-2026-111823CRITICALMage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.EPSS 0.6%CVE-2026-114137HIGHDjango REST framework: TokenProxy.delete() reports success and revokes nothingEPSS 0.5%CVE-2024-20316MEDIUMA vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to accesEPSS 0.5%CVE-2026-85716LOWAsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verifiedEPSS 0.4%CVE-2025-25204MEDIUM`gh attestation verify` returns incorrect exit code during verification if no attestations are presentEPSS 0.4%CVE-2026-104480CRITICALImproper MLS Welcome roster validation in Discord libdave allows unauthorized group membershipEPSS 0.4%CVE-2024-11942MEDIUMDrupal core - Moderately critical - Improper error handling - SA-CORE-2024-002EPSS 0.4%CVE-2026-52989CRITICALnvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callersEPSS 0.4%CVE-2026-107275MEDIUM@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsedEPSS 0.3%CVE-2026-29810MEDIUMCyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.EPSS 0.3%CVE-2026-104002MEDIUMFail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)EPSS 0.3%