Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2024-52504HIGHA vulnerability has been identified in SIPROTEC 4 6MD61 (All versions), SIPROTEC 4 6MD63 (All versions), SIPROTEC 4 6MD66 (All versions), SIEPSS 0.4%CVE-2025-61668HIGH@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous userEPSS 0.4%CVE-2024-38461HIGHirodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory.EPSS 0.4%CVE-2026-4708HIGHIncorrect boundary conditions in the Graphics componentEPSS 0.4%CVE-2026-4713HIGHIncorrect boundary conditions in the Graphics componentEPSS 0.4%CVE-2026-4714HIGHIncorrect boundary conditions in the Audio/Video componentEPSS 0.4%CVE-2022-3616MEDIUMOctoRPKI crash when maximum iterations number is reachedEPSS 0.4%CVE-2024-5469LOWUncontrolled Resource Consumption in GitLabEPSS 0.4%CVE-2025-0130HIGHPAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted PacketsEPSS 0.4%CVE-2026-43928LOWFOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpaymentEPSS 0.4%CVE-2025-60004HIGHJunos OS and Junos OS Evolved: Specific BGP EVPN update message causes rpd crashEPSS 0.4%CVE-2026-44324MEDIUMfree5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)EPSS 0.4%CVE-2026-8075MEDIUMPosting a malicious markdown image crashes the Mattermost Desktop AppEPSS 0.4%CVE-2025-21594HIGHJunos OS: MX Series: In DS-lite and NAT scenario receipt of crafted IPv6 traffic causes port blockEPSS 0.4%CVE-2025-30660HIGHJunos OS: MX Series: Decapsulation of specific GRE packets leads to PFE resetEPSS 0.4%CVE-2025-69250MEDIUMfree5GC has Improper Error Handling in UDM, Leading to Information ExposureEPSS 0.4%CVE-2026-35225HIGHImproper timeout handling in CODESYS EtherNetIPEPSS 0.4%CVE-2026-77411CRITICALRabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstrEPSS 0.4%CVE-2024-52895MEDIUMIBM i denial of serviceEPSS 0.4%CVE-2026-57022HIGHJunos OS: MX Series with SPC3, SRX Series: Specific packet in response to a TCP connection establishment by the affected device can crash the PFEEPSS 0.4%