Weaknesses of type CWE-754

508 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2025-53359MEDIUMethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactionsEPSS 0.4%CVE-2026-79073HIGHImproper state validation in Parser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code EPSS 0.4%CVE-2026-35225HIGHImproper timeout handling in CODESYS EtherNetIPEPSS 0.4%CVE-2024-52895MEDIUMIBM i denial of serviceEPSS 0.4%CVE-2026-33794HIGHJunos OS Evolved: PTX Series: Receipt of repeated ECMP routing updates results in PFE crashEPSS 0.4%CVE-2026-57022HIGHJunos OS: MX Series with SPC3, SRX Series: Specific packet in response to a TCP connection establishment by the affected device can crash the PFEEPSS 0.4%CVE-2026-44316HIGHfree5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereferenceEPSS 0.4%CVE-2021-0228MEDIUMJunos OS: MX Series: DDoS LACP violation upon receipt of specific layer 2 frames in EVPN-VXLAN deploymentEPSS 0.4%CVE-2026-54269MEDIUMprotobufjs: Schema-derived names can shadow runtime-significant propertiesEPSS 0.4%CVE-2026-121098HIGHImproper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process EPSS 0.4%CVE-2024-39559HIGHJunos OS Evolved: Receipt of a specific TCP packet may result in a system crash (vmcore) on dual RE systems with NSR enabledEPSS 0.4%CVE-2026-73288MEDIUMRustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deletedEPSS 0.4%CVE-2025-61976HIGHCHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. If a remote attacker sends aEPSS 0.4%CVE-2025-12657MEDIUMMalformed KMIP response may result in access violationEPSS 0.4%CVE-2026-44322HIGHfree5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferenceEPSS 0.4%CVE-2026-6772HIGHIncorrect boundary conditions in the Libraries component in NSSEPSS 0.4%CVE-2022-22196MEDIUMJunos OS and Junos OS Evolved: The rpd CPU spikes to 100% after a malformed ISIS TLV has been receivedEPSS 0.4%CVE-2021-0239MEDIUMJunos OS Evolved: Denial of Service due to receipt of specific genuine layer 2 frames.EPSS 0.4%CVE-2021-0288MEDIUMJunos OS: MX Series, EX9200 Series: FPC may crash upon receipt of specific MPLS packet affecting Trio-based MPCsEPSS 0.4%CVE-2026-121445HIGHsvg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS StrippingEPSS 0.4%