Weaknesses of type CWE-476

2,328 results

Desreferência de nulo autenticada remota

A aplicação não valida corretamente se um ponteiro ou referência é nulo antes de usá-lo, permitindo que um usuário autenticado remotamente forneça entrada que causa uma desreferência de nulo. O resultado é um crash da aplicação ou, em cenários mais graves, execução de código não prevista, dependendo de como a memória é tratada.

Example

Um endpoint de API autenticada que busca um usuário por ID, mas não verifica se o resultado da busca é nulo. Um atacante autenticado fornece um ID inexistente, o código tenta acessar propriedades do resultado nulo e a aplicação falha ou se comporta de forma imprevista.

How to mitigate

Sempre validar retornos de funções que podem ser nulos antes de acessar seus membros ou métodos. Use assertions, verificações explícitas (if obj != null) ou mecanismos de linguagem como optional/Maybe types para forçar o tratamento seguro de valores nulos.

CVE-2024-36387MEDIUMApache HTTP Server: DoS by Null pointer in websocket over HTTP/2EPSS 1.7%CVE-2024-47007HIGHA NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to caEPSS 1.7%CVE-2025-11847MEDIUMA null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0EPSS 1.7%CVE-2021-3480—A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauEPSS 1.7%CVE-2026-59132HIGHWindows TCP/IP Denial of Service VulnerabilityEPSS 1.7%CVE-2023-21700HIGHWindows iSCSI Discovery Service Denial of Service VulnerabilityEPSS 1.7%CVE-2023-24859HIGHWindows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityEPSS 1.7%CVE-2020-26235MEDIUMSegmentation fault in Rust time crateEPSS 1.6%CVE-2024-27053HIGHwifi: wilc1000: fix RCU usage in connect pathEPSS 1.6%CVE-2021-4110CRITICALNULL Pointer Dereference in mruby/mrubyEPSS 1.6%CVE-2023-3354HIGHImproper i/o watch removal in tls handshake can lead to remote unauthenticated denial of serviceEPSS 1.6%CVE-2022-1620MEDIUMNULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in vim/vimEPSS 1.6%CVE-2022-32663HIGHIn Wi-Fi driver, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additEPSS 1.6%CVE-2020-5736—Amcrest cameras and NVR are vulnerable to a null pointer dereference over port 37777. An authenticated remote attacker can abuse this issue EPSS 1.6%CVE-2021-20213—A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if accept-intercepted-requEPSS 1.6%CVE-2023-39351MEDIUMFreeRDP Null Pointer Dereference leading denial of serviceEPSS 1.6%CVE-2026-20875HIGHWindows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityEPSS 1.6%CVE-2011-1282HIGHThe Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, WindowEPSS 1.6%CVE-2023-6535MEDIUMKernel: null pointer dereference in nvmet_tcp_execute_requestEPSS 1.5%CVE-2023-6536MEDIUMKernel: null pointer dereference in __nvmet_req_completeEPSS 1.5%