Weaknesses of type CWE-703

174 results

Tratamento inadequado de condições de erro

Quando o código não verifica ou trata corretamente situações anormais (erros, exceções, valores inesperados), ele pode se comportar de forma impredizível ou insegura. O programa segue um caminho que não deveria, ignorando sinais de falha que poderiam evitar consequências maiores.

Example

Um serviço lê um arquivo de configuração sem verificar se a leitura falhou; se o arquivo não existir, as variáveis ficam vazias ou com lixo de memória, e o programa usa valores inválidos em decisões críticas de segurança, abrindo brechas para ataques.

How to mitigate

Sempre capture e trate exceções explicitamente, valide retornos de função (códigos de erro, null, valores fora do escopo), e log eventos anômalos. Implemente fallbacks sensatos e recuse operações quando o estado não for confiável.

CVE-2022-23002MEDIUMPoint Compression/Decompression of NIST P-256 points with X coordinate of zeroEPSS 0.7%CVE-2022-23004MEDIUMAlgorithm incorrectly returning error and Invalid unreduced value written to output bufferEPSS 0.7%CVE-2026-21720HIGHUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outEPSS 0.7%CVE-2025-70758HIGHchetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/auth_validate.php. The apEPSS 0.6%CVE-2023-22413HIGHJunos OS: MX Series: The Multiservices PIC Management Daemon (mspmand) will crash when an IPsec6 tunnel processes specific IPv4 packetsEPSS 0.6%CVE-2021-23261MEDIUMOverriding the system configuration file causes a denial of serviceEPSS 0.6%CVE-2026-32641HIGHParseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middlewareEPSS 0.6%CVE-2023-36831HIGHJunos OS: SRX Series: jbuf memory leak when SSL Proxy and UTM Web-Filtering is appliedEPSS 0.6%CVE-2023-28965MEDIUMJunos OS: QFX10002: Failure of storm control feature may lead to Denial of ServiceEPSS 0.6%CVE-2026-44893HIGHNetty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthEPSS 0.6%CVE-2021-3329CRITICALDOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layerEPSS 0.6%CVE-2021-25380MEDIUMImproper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the useEPSS 0.6%CVE-2024-31883MEDIUMIBM Security Verify Access denial of serviceEPSS 0.6%CVE-2025-59531HIGHUnauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payloadEPSS 0.6%CVE-2024-27832CRITICALThe issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, wEPSS 0.6%CVE-2025-59836MEDIUMOmni is Vulnerable to DoS via Empty Create/Update Resource RequestsEPSS 0.6%CVE-2022-34472MEDIUMIf there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrecEPSS 0.6%CVE-2025-24188MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 18.6, macOS Sequoia 15.6. Processing maliciously crafted webEPSS 0.6%CVE-2024-21629MEDIUMErroneous handling of `record_external_operation` error returnEPSS 0.6%CVE-2026-51600HIGHTenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY mEPSS 0.6%