Weaknesses of type CWE-703
154 resultsTratamento inadequado de condições de erro
Quando o código não verifica ou trata corretamente situações anormais (erros, exceções, valores inesperados), ele pode se comportar de forma impredizível ou insegura. O programa segue um caminho que não deveria, ignorando sinais de falha que poderiam evitar consequências maiores.
Example
Um serviço lê um arquivo de configuração sem verificar se a leitura falhou; se o arquivo não existir, as variáveis ficam vazias ou com lixo de memória, e o programa usa valores inválidos em decisões críticas de segurança, abrindo brechas para ataques.
How to mitigate
Sempre capture e trate exceções explicitamente, valide retornos de função (códigos de erro, null, valores fora do escopo), e log eventos anômalos. Implemente fallbacks sensatos e recuse operações quando o estado não for confiável.
CVE-2024-21894HIGHA heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malEPSS 19.0%CVE-2025-59538HIGHArgo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookEPSS 8.3%CVE-2019-5031HIGHAn exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. A EPSS 6.0%CVE-2023-49786HIGHAsterisk susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 5.3%CVE-2024-10781HIGHSpam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin InstallationEPSS 3.8%CVE-2024-22052HIGHA null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenEPSS 3.8%CVE-2024-22053HIGHA heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x
22.x) and Ivanti Policy Secure allows an unauthenticated malEPSS 3.5%CVE-2024-22023MEDIUMAn XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unautEPSS 3.0%CVE-2017-16014—Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crashEPSS 1.7%CVE-2024-29205HIGHAn Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti PEPSS 1.6%CVE-2022-25252HIGHPTC Axeda agent and Axeda Desktop Server Improper Check or Handling Of Exceptional ConditionsEPSS 1.6%CVE-2023-51443HIGHFreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 1.5%CVE-2022-41777HIGHImproper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlEPSS 1.5%CVE-2018-12551—When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the pEPSS 1.5%CVE-2020-2075—Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LEPSS 1.4%CVE-2020-1644HIGHJunos OS and Junos OS Evolved: RPD crash due to specific BGP UPDATE packetsEPSS 1.3%CVE-2019-10927—A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCAEPSS 1.2%CVE-2024-26007MEDIUMAn improper check or handling of exceptional conditions vulnerability [CWE-703] in Fortinet FortiOS version 7.4.1 allows an unauthenticated EPSS 1.2%CVE-2023-0004MEDIUMPAN-OS: Local File Deletion VulnerabilityEPSS 1.1%CVE-2020-1639HIGHJunos OS: A crafted Ethernet OAM packet received by Junos may cause the Ethernet OAM connectivity fault management process (CFM) to core.EPSS 1.1%