Weaknesses of type CWE-476

2,328 results

Desreferência de nulo autenticada remota

A aplicação não valida corretamente se um ponteiro ou referência é nulo antes de usá-lo, permitindo que um usuário autenticado remotamente forneça entrada que causa uma desreferência de nulo. O resultado é um crash da aplicação ou, em cenários mais graves, execução de código não prevista, dependendo de como a memória é tratada.

Example

Um endpoint de API autenticada que busca um usuário por ID, mas não verifica se o resultado da busca é nulo. Um atacante autenticado fornece um ID inexistente, o código tenta acessar propriedades do resultado nulo e a aplicação falha ou se comporta de forma imprevista.

How to mitigate

Sempre validar retornos de funções que podem ser nulos antes de acessar seus membros ou métodos. Use assertions, verificações explícitas (if obj != null) ou mecanismos de linguagem como optional/Maybe types para forçar o tratamento seguro de valores nulos.

CVE-2017-7502—Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of servEPSS 4.2%CVE-2023-32252HIGHSession null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2023-32248HIGHTree connection null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2021-44740LOWAdobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-serviceEPSS 3.6%CVE-2021-44741LOWAdobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-serviceEPSS 3.6%CVE-2020-7062HIGHNull Pointer Dereference in PHP Session Upload ProgressEPSS 3.6%CVE-2020-8859MEDIUMThis vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.EPSS 3.6%CVE-2024-47586MEDIUMNULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP PlatformEPSS 3.5%CVE-2018-14404MEDIUMA NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invaliEPSS 3.5%CVE-2021-3537—A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing aEPSS 3.5%CVE-2018-18066HIGHsnmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attackEPSS 3.5%CVE-2020-5762—Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service. An unauEPSS 3.4%CVE-2018-16851MEDIUMSamba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP seaEPSS 3.3%CVE-2018-16852MEDIUMSamba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the EPSS 3.2%CVE-2014-0757—Smart Software Solutions (3S) CoDeSys Runtime Toolkit NULL Pointer DereferenceEPSS 3.2%CVE-2004-0458HIGHmah-jong before 1.6.2 allows remote attackers to cause a denial of service (server crash) via a missing argument, which triggers a null poinEPSS 3.2%CVE-2020-3481HIGHClam AntiVirus (ClamAV) Software Null Pointer Dereference VulnerabilityEPSS 3.2%CVE-2017-9631—A Null Pointer Dereference issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. The nEPSS 3.2%CVE-2024-0727MEDIUMPKCS12 Decoding crashesEPSS 3.2%CVE-2021-21702MEDIUMNull Dereference in SoapClientEPSS 3.2%