Weaknesses of type CWE-390

22 results

Detecção de erro sem tratamento

O código verifica se um erro ocorreu, mas não faz nada a respeito — simplesmente ignora ou continua a execução. Isso permite que operações falhem silenciosamente, deixando o programa em estado inconsistente ou processando dados inválidos sem o operador saber.

Example

Um aplicativo tenta abrir um arquivo de configuração, verifica se houve erro na abertura, mas segue adiante usando valores padrão incorretos ou parcialmente lidos. Um atacante pode forçar a falha da leitura e explorar o comportamento degradado para contornar validações de segurança.

How to mitigate

Sempre implemente ação explícita após detectar erro: lance exceção, registre em log, falhe seguro ou notifique o operador. Não deixe código dormindo após validação — teste e documente o que deve acontecer em cada cenário de falha.

CVE-2024-30255MEDIUMHTTP/2: CPU exhaustion due to CONTINUATION frame floodEPSS 87.8%CVE-2024-27919HIGHHTTP/2: memory exhaustion due to CONTINUATION frame floodEPSS 86.7%CVE-2025-26465MEDIUMOpenssh: machine-in-the-middle attack if verifyhostkeydns is enabledEPSS 7.7%CVE-2019-5051HIGHAn exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handlerEPSS 3.9%CVE-2021-40391CRITICALAn out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and EPSS 3.0%CVE-2017-7485—In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL envirEPSS 2.0%CVE-2024-12086MEDIUMRsync: rsync server leaks arbitrary client filesEPSS 1.8%CVE-2026-53434CRITICALApache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM ConnectorEPSS 0.6%CVE-2026-52989CRITICALnvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callersEPSS 0.5%CVE-2024-20316MEDIUMA vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to accesEPSS 0.5%CVE-2026-85716LOWAsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verifiedEPSS 0.4%CVE-2025-25204MEDIUM`gh attestation verify` returns incorrect exit code during verification if no attestations are presentEPSS 0.4%CVE-2024-11942MEDIUMDrupal core - Moderately critical - Improper error handling - SA-CORE-2024-002EPSS 0.4%CVE-2026-29810MEDIUMCyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.EPSS 0.3%CVE-2026-48792MEDIUMpam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root executionEPSS 0.2%CVE-2026-76642HIGHutil-linux libmount Privilege Escalation via Failed Mount HelperEPSS 0.2%CVE-2026-44310MEDIUMgitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callersEPSS 0.2%CVE-2026-59845MEDIUMLibssh: libssh: denial of service via unchecked proxycommand fork() failureEPSS 0.1%CVE-2025-46367HIGHDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. EPSS 0.1%CVE-2025-0029LOWImproper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writeEPSS 0.1%