Weaknesses of type CWE-476

2,331 results

Desreferência de nulo autenticada remota

A aplicação não valida corretamente se um ponteiro ou referência é nulo antes de usá-lo, permitindo que um usuário autenticado remotamente forneça entrada que causa uma desreferência de nulo. O resultado é um crash da aplicação ou, em cenários mais graves, execução de código não prevista, dependendo de como a memória é tratada.

Example

Um endpoint de API autenticada que busca um usuário por ID, mas não verifica se o resultado da busca é nulo. Um atacante autenticado fornece um ID inexistente, o código tenta acessar propriedades do resultado nulo e a aplicação falha ou se comporta de forma imprevista.

How to mitigate

Sempre validar retornos de funções que podem ser nulos antes de acessar seus membros ou métodos. Use assertions, verificações explícitas (if obj != null) ou mecanismos de linguagem como optional/Maybe types para forçar o tratamento seguro de valores nulos.

CVE-2018-1000168HIGHnghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that caEPSS 10.6%CVE-2020-25858—The QCMAP_Web_CLIENT binary in the Qualcomm QCMAP software suite prior to versions released in October 2020 does not validate the return valEPSS 9.6%CVE-2004-0079HIGHThe do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (EPSS 9.5%CVE-2018-1172—This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-2018031EPSS 8.3%CVE-2023-3338MEDIUMCrash due to a null pointer dereference in the dn_nsp_send functionEPSS 8.0%CVE-2025-63655HIGHA NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a DeEPSS 7.8%CVE-2022-32230HIGHSMBv3 FileNormalizedNameInformation NULL Pointer DereferenceEPSS 7.5%CVE-2020-1971MEDIUMEDIPARTYNAME NULL pointer dereferenceEPSS 7.1%CVE-2018-1050—All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run aEPSS 6.5%CVE-2023-46728HIGHSQUID-2021:8 Denial of Service in Gopher gatewayEPSS 6.0%CVE-2026-32854MEDIUMLibVNCServer httpd proxy NULL Pointer DereferenceEPSS 5.3%CVE-2017-2634HIGHIt was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used the IPv4-only inet_sk_EPSS 5.2%CVE-2023-24940HIGHWindows Pragmatic General Multicast (PGM) Denial of Service VulnerabilityEPSS 5.2%CVE-2026-21525MEDIUMWindows Remote Access Connection Manager Denial of Service VulnerabilityEPSS 5.0%KEVCVE-2025-60332HIGHA NULL pointer dereference in the SetWLanRadioSettings function of D-Link DIR-823G A1 v1.0.2B05 allows attackers to cause a Denial of ServicEPSS 5.0%CVE-2013-6954MEDIUMThe png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL pointer dereference andEPSS 4.7%CVE-2025-11187MEDIUMImproper validation of PBMAC1 parameters in PKCS#12 MAC verificationEPSS 4.7%CVE-2021-4043MEDIUMNULL Pointer Dereference in gpac/gpacEPSS 4.6%CVE-2022-35691MEDIUMAdobe Acrobat Reader NULL Pointer Dereference Application denial-of-serviceEPSS 4.4%CVE-2017-7502—Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of servEPSS 4.3%