Weaknesses of type CWE-703

181 results

Tratamento inadequado de condições de erro

Quando o código não verifica ou trata corretamente situações anormais (erros, exceções, valores inesperados), ele pode se comportar de forma impredizível ou insegura. O programa segue um caminho que não deveria, ignorando sinais de falha que poderiam evitar consequências maiores.

Example

Um serviço lê um arquivo de configuração sem verificar se a leitura falhou; se o arquivo não existir, as variáveis ficam vazias ou com lixo de memória, e o programa usa valores inválidos em decisões críticas de segurança, abrindo brechas para ataques.

How to mitigate

Sempre capture e trate exceções explicitamente, valide retornos de função (códigos de erro, null, valores fora do escopo), e log eventos anômalos. Implemente fallbacks sensatos e recuse operações quando o estado não for confiável.

CVE-2022-34472MEDIUMIf there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrecEPSS 0.6%CVE-2019-11245MEDIUMkubelet-started container uid changes to root after first restart or if image is already pulled to the nodeEPSS 0.6%CVE-2025-14874HIGHNodemailer: nodemailer: denial of service via crafted email address headerEPSS 0.6%CVE-2025-24188MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 18.6, macOS Sequoia 15.6. Processing maliciously crafted webEPSS 0.6%CVE-2024-31883MEDIUMIBM Security Verify Access denial of serviceEPSS 0.6%CVE-2025-59531HIGHUnauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payloadEPSS 0.6%CVE-2024-27832CRITICALThe issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, wEPSS 0.6%CVE-2025-59836MEDIUMOmni is Vulnerable to DoS via Empty Create/Update Resource RequestsEPSS 0.6%CVE-2024-21629MEDIUMErroneous handling of `record_external_operation` error returnEPSS 0.6%CVE-2022-41589HIGHThe DFX unwind stack module of the ArkCompiler has a vulnerability in interface calling.Successful exploitation of this vulnerability affectEPSS 0.6%CVE-2026-51600HIGHTenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY mEPSS 0.6%CVE-2022-30738MEDIUMImproper check in Loader in Samsung Internet prior to 17.0.1.69 allows attackers to spoof address bar via executing script.EPSS 0.6%CVE-2023-35867MEDIUMAn improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker toEPSS 0.6%CVE-2023-34348HIGHImproper Check or Handling of Exceptional Conditions in Aveva PI Server EPSS 0.6%CVE-2026-84579HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. OpeningEPSS 0.6%CVE-2025-43427MEDIUMThis issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, EPSS 0.5%CVE-2024-21525HIGHAll versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the sourcEPSS 0.5%CVE-2026-61822MEDIUMpg_partman disable maintenance for all partition setsEPSS 0.5%CVE-2023-5563HIGHThe SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOEPSS 0.5%CVE-2026-92790MEDIUMHigress before 2.2.4 Rate Limit Bypass via Malformed Cookie HeaderEPSS 0.5%