Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2024-24567MEDIUMraw_call `value=` kwargs not disabled for static and delegate callsEPSS 0.5%CVE-2024-30409MEDIUMJunos OS and Junos OS Evolved: Higher CPU consumption on routing engine leads to Denial of Service (DoS).EPSS 0.5%CVE-2024-39530HIGHJunos OS: Attempting to access specific sensors on platforms not supporting these will lead to a chassisd crashEPSS 0.5%CVE-2024-1556MEDIUMThe incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and undefined behavior. *NoEPSS 0.5%CVE-2023-30456MEDIUMAn issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CEPSS 0.5%CVE-2024-26008MEDIUMAn improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, ForEPSS 0.5%CVE-2025-60011MEDIUMJunos OS and Junos OS Evolved: Optional transitive BGP attribute is modified before propagation to peers causing sessions to flapEPSS 0.5%CVE-2026-8091CRITICALIncorrect boundary conditions in the Audio/Video: Playback componentEPSS 0.5%CVE-2024-11599HIGHDomain Restriction Bypass on RegistrationEPSS 0.5%CVE-2025-32997MEDIUMIn http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.EPSS 0.5%CVE-2026-4709HIGHIncorrect boundary conditions in the Audio/Video: GMP componentEPSS 0.5%CVE-2024-39832MEDIUMPermanently local data deletion by malicious remoteEPSS 0.5%CVE-2022-41587MEDIUMUncaptured exceptions in the home screen module. Successful exploitation of this vulnerability may affect stability.EPSS 0.5%CVE-2026-24054HIGHKata Containers Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layersEPSS 0.5%CVE-2026-4706HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.5%CVE-2025-23197MEDIUMmatrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub supportEPSS 0.5%CVE-2026-73314HIGHXenForo < 2.3.13 Signature Verification Bypass via PayPal REST WebhookEPSS 0.5%CVE-2026-63754HIGHSurrealDB before 3.1.0 Denial of Service via LIVE QueryEPSS 0.4%CVE-2024-52504HIGHA vulnerability has been identified in SIPROTEC 4 6MD61 (All versions), SIPROTEC 4 6MD63 (All versions), SIPROTEC 4 6MD66 (All versions), SIEPSS 0.4%CVE-2022-22218HIGHJunos OS: SRX Series: Upon processing of a genuine packet the pkid process will crash during CMPv2 auto-re-enrollmentEPSS 0.4%