Weaknesses of type CWE-476

2,329 results

Desreferência de nulo autenticada remota

A aplicação não valida corretamente se um ponteiro ou referência é nulo antes de usá-lo, permitindo que um usuário autenticado remotamente forneça entrada que causa uma desreferência de nulo. O resultado é um crash da aplicação ou, em cenários mais graves, execução de código não prevista, dependendo de como a memória é tratada.

Example

Um endpoint de API autenticada que busca um usuário por ID, mas não verifica se o resultado da busca é nulo. Um atacante autenticado fornece um ID inexistente, o código tenta acessar propriedades do resultado nulo e a aplicação falha ou se comporta de forma imprevista.

How to mitigate

Sempre validar retornos de funções que podem ser nulos antes de acessar seus membros ou métodos. Use assertions, verificações explícitas (if obj != null) ou mecanismos de linguagem como optional/Maybe types para forçar o tratamento seguro de valores nulos.

CVE-2024-37890HIGHDenial of service when handling a request with many HTTP headers in wsEPSS 1.4%CVE-2023-32171MEDIUMUnified Automation UaGateway OPC UA Server Null Pointer Dereference Denial-of-Service VulnerabilityEPSS 1.4%CVE-2023-2617MEDIUMOpenCV wechat_qrcode Module decoded_bit_stream_parser.cpp decodeByteSegment null pointer dereferenceEPSS 1.4%CVE-2021-23180—A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension(),in file.c may lead to execute arbitrary codeEPSS 1.4%CVE-2026-63076HIGHInvalid Pointer Dereference in CMP Server via Crafted protectionAlgEPSS 1.4%CVE-2011-1231HIGHwin32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows ServeEPSS 1.3%CVE-2022-20746HIGHCisco Firepower Threat Defense Software TCP Proxy Denial of Service VulnerabilityEPSS 1.3%CVE-2019-14878MEDIUMIn the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate aEPSS 1.3%CVE-2019-14877MEDIUMIn the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocateEPSS 1.3%CVE-2019-14876MEDIUMIn the __lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocatEPSS 1.3%CVE-2019-14874MEDIUMIn the __i2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate aEPSS 1.3%CVE-2009-2516HIGHThe kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly validaEPSS 1.3%CVE-2021-40778MEDIUMAdobe Media Encoder Null Pointer Dereference Application denial-of-serviceEPSS 1.3%CVE-2021-40781MEDIUMAdobe Media Encoder Null Pointer Dereference Application denial-of-serviceEPSS 1.3%CVE-2021-40750MEDIUMAdobe Bridge NULL Pointer Dereference could lead to Application denial-of-serviceEPSS 1.3%CVE-2011-1881HIGHwin32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows ServeEPSS 1.3%CVE-2021-34737MEDIUMCisco IOS XR Software DHCP Version 4 Server Denial of Service VulnerabilityEPSS 1.3%CVE-2022-43603MEDIUMA denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially EPSS 1.3%CVE-2022-43593MEDIUMA denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crEPSS 1.3%CVE-2026-1584HIGHGnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binderEPSS 1.3%