Weaknesses of type CWE-476

2,331 results

Desreferência de nulo autenticada remota

A aplicação não valida corretamente se um ponteiro ou referência é nulo antes de usá-lo, permitindo que um usuário autenticado remotamente forneça entrada que causa uma desreferência de nulo. O resultado é um crash da aplicação ou, em cenários mais graves, execução de código não prevista, dependendo de como a memória é tratada.

Example

Um endpoint de API autenticada que busca um usuário por ID, mas não verifica se o resultado da busca é nulo. Um atacante autenticado fornece um ID inexistente, o código tenta acessar propriedades do resultado nulo e a aplicação falha ou se comporta de forma imprevista.

How to mitigate

Sempre validar retornos de funções que podem ser nulos antes de acessar seus membros ou métodos. Use assertions, verificações explícitas (if obj != null) ou mecanismos de linguagem como optional/Maybe types para forçar o tratamento seguro de valores nulos.

CVE-2023-23087CRITICALAn issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function.EPSS 0.9%CVE-2024-20436HIGHA vulnerability in the HTTP Server feature of Cisco IOS XE Software when the Telephony Service feature is enabled could allow an unauthenticEPSS 0.9%CVE-2022-2980MEDIUMNULL Pointer Dereference in vim/vimEPSS 0.9%CVE-2023-5590HIGHNULL Pointer Dereference in seleniumhq/seleniumEPSS 0.9%CVE-2023-24822HIGHRIOT-OS vulnerable to Null Pointer dereference during IPHC encodingEPSS 0.9%CVE-2021-4188MEDIUMNULL Pointer Dereference in mruby/mrubyEPSS 0.9%CVE-2026-18453HIGH389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_searchEPSS 0.8%CVE-2024-26924HIGHnetfilter: nft_set_pipapo: do not free live elementEPSS 0.8%CVE-2021-3320MEDIUMType Confusion in 802154 ACK Frames HandlingEPSS 0.8%CVE-2023-29996HIGHIn NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and unsubinfo_decode.EPSS 0.8%CVE-2025-24177HIGHA null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macEPSS 0.8%CVE-2021-40027—The bone voice ID TA has a vulnerability in calculating the buffer length,Successful exploitation of this vulnerability may affect data confEPSS 0.8%CVE-2020-10600MEDIUMOSIsoft PI SystemEPSS 0.8%CVE-2026-76166MEDIUMModcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagramEPSS 0.8%CVE-2021-33068MEDIUMNull pointer dereference in subsystem for Intel(R) AMT before versions 15.0.35 may allow an authenticated user to potentially enable denial EPSS 0.8%CVE-2023-33306MEDIUMA null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allEPSS 0.8%CVE-2022-44018HIGHIn Softing uaToolkit Embedded before 1.40.1, a malformed PubSub discovery announcement message can cause a NULL pointer dereference or out-oEPSS 0.8%CVE-2018-6343HIGHProxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsiEPSS 0.8%CVE-2024-26130HIGHcryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash overrideEPSS 0.8%CVE-2022-36661MEDIUMxhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_read(). This vulnerability allows attackeEPSS 0.8%