Weaknesses of type CWE-476

2,328 results

Desreferência de nulo autenticada remota

A aplicação não valida corretamente se um ponteiro ou referência é nulo antes de usá-lo, permitindo que um usuário autenticado remotamente forneça entrada que causa uma desreferência de nulo. O resultado é um crash da aplicação ou, em cenários mais graves, execução de código não prevista, dependendo de como a memória é tratada.

Example

Um endpoint de API autenticada que busca um usuário por ID, mas não verifica se o resultado da busca é nulo. Um atacante autenticado fornece um ID inexistente, o código tenta acessar propriedades do resultado nulo e a aplicação falha ou se comporta de forma imprevista.

How to mitigate

Sempre validar retornos de funções que podem ser nulos antes de acessar seus membros ou métodos. Use assertions, verificações explícitas (if obj != null) ou mecanismos de linguagem como optional/Maybe types para forçar o tratamento seguro de valores nulos.

CVE-2024-38477HIGHApache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious requestEPSS 3.2%CVE-2020-1730MEDIUMA flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The serEPSS 3.1%CVE-2024-26219HIGHHTTP.sys Denial of Service VulnerabilityEPSS 3.1%CVE-2019-5054HIGHAn exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000v5 with Firmware VerEPSS 3.1%CVE-2020-10711MEDIUMA NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing tEPSS 3.1%CVE-2020-13574HIGHA denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request EPSS 3.0%CVE-2020-13577HIGHA denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request EPSS 3.0%CVE-2021-38604HIGHIn librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading EPSS 3.0%CVE-2020-13578HIGHA denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request EPSS 3.0%CVE-2019-9923HIGHpax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extendEPSS 3.0%CVE-2017-11185HIGHThe gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) vEPSS 2.8%CVE-2024-20661HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.8%CVE-2024-21404HIGH.NET Denial of Service VulnerabilityEPSS 2.7%CVE-2018-16871HIGHA flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mouEPSS 2.7%CVE-2022-2309MEDIUMNULL Pointer Dereference in lxml/lxmlEPSS 2.7%CVE-2019-15680—TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack EPSS 2.7%CVE-2026-3238HIGHSamba: denial of service against ad dc wins serverEPSS 2.7%CVE-2021-22570MEDIUMNullptr Dereference in ProtobufEPSS 2.7%CVE-2024-38126HIGHWindows Network Address Translation (NAT) Denial of Service VulnerabilityEPSS 2.7%CVE-2023-29180HIGHA null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14EPSS 2.6%