Weaknesses of type CWE-476

2,333 results

Desreferência de nulo autenticada remota

A aplicação não valida corretamente se um ponteiro ou referência é nulo antes de usá-lo, permitindo que um usuário autenticado remotamente forneça entrada que causa uma desreferência de nulo. O resultado é um crash da aplicação ou, em cenários mais graves, execução de código não prevista, dependendo de como a memória é tratada.

Example

Um endpoint de API autenticada que busca um usuário por ID, mas não verifica se o resultado da busca é nulo. Um atacante autenticado fornece um ID inexistente, o código tenta acessar propriedades do resultado nulo e a aplicação falha ou se comporta de forma imprevista.

How to mitigate

Sempre validar retornos de funções que podem ser nulos antes de acessar seus membros ou métodos. Use assertions, verificações explícitas (if obj != null) ou mecanismos de linguagem como optional/Maybe types para forçar o tratamento seguro de valores nulos.

CVE-2026-75013HIGHTOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereferenceEPSS 0.7%CVE-2026-75012HIGHTOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereferenceEPSS 0.7%CVE-2021-39977HIGHThe HwNearbyMain module has a NULL Pointer Dereference vulnerability.Successful exploitation of this vulnerability may cause a process to reEPSS 0.7%CVE-2026-45084HIGHOpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type stateEPSS 0.7%CVE-2026-27141HIGHSending certain HTTP/2 frames can cause a server to panic in golang.org/x/netEPSS 0.7%CVE-2023-2840MEDIUMNULL Pointer Dereference in gpac/gpacEPSS 0.7%CVE-2024-23078CRITICALJGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compaEPSS 0.7%CVE-2026-67304HIGHFreeRDP before 3.29.0 NULL Dereference via smartcard cleanupEPSS 0.7%CVE-2025-31115HIGHXZ has a heap-use-after-free bug in threaded .xz decoderEPSS 0.7%CVE-2024-31755HIGHcJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSON_SetValuesEPSS 0.6%CVE-2024-31420MEDIUMCnv: dos through repeatedly calling vm-dump-metrics until virt handler crashesEPSS 0.6%CVE-2024-36476CRITICALRDMA/rtrs: Ensure 'ib_sge list' is accessibleEPSS 0.6%CVE-2023-31129HIGHContiki-NG missing NULL pointer check in IPv6 neighbor discoveryEPSS 0.6%CVE-2022-49065HIGHSUNRPC: Fix the svc_deferred_event trace classEPSS 0.6%CVE-2024-27660MEDIUMD-Link DIR-823G A1V1.0.2B05 was discovered to contain a Null-pointer dereferences in sub_41C488(). This vulnerability allows attackers to caEPSS 0.6%CVE-2025-53817MEDIUMGHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStreamEPSS 0.6%CVE-2023-48183HIGHQuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval.EPSS 0.6%CVE-2026-37226HIGHFlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup function returnEPSS 0.6%CVE-2026-37230HIGHFlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a ran_func_id that does not exist in its registry. The loEPSS 0.6%CVE-2024-20266MEDIUMA vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trEPSS 0.6%