Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2026-21693HIGHiccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cppEPSS 0.4%CVE-2026-0262MEDIUMPAN-OS: Denial of Service Vulnerabilities in Network Traffic ParsingEPSS 0.4%CVE-2023-4828MEDIUMITM Server Communications HijackEPSS 0.4%CVE-2023-44198MEDIUMJunos OS: SRX Series and MX Series: SIP ALG doesn't drop specifically malformed retransmitted SIP packetsEPSS 0.4%CVE-2026-73429MEDIUMRussh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)EPSS 0.4%CVE-2026-20776HIGHImproper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. NetwoEPSS 0.4%CVE-2023-28910HIGHDisabled Abortion FlagEPSS 0.4%CVE-2022-20804MEDIUMCisco Unified Communications Products Denial of Service VulnerabilityEPSS 0.4%CVE-2026-20719MEDIUMDoS via URL Previews Rendering Malicious SVGsEPSS 0.4%CVE-2026-44317MEDIUMfree5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereferenceEPSS 0.4%CVE-2024-30397HIGHJunos OS: An invalid certificate causes a Denial of Service in the Internet Key Exchange (IKE) processEPSS 0.3%CVE-2026-46541HIGHNimiq network-libp2p: DHT query poisoning via first-record verification failureEPSS 0.3%CVE-2024-43435MEDIUMMoodle: can create global glossary without being adminEPSS 0.3%CVE-2026-55484HIGHALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire serverEPSS 0.3%CVE-2026-45678HIGHOpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloadsEPSS 0.3%CVE-2025-14322HIGHSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL componentEPSS 0.3%CVE-2022-22217MEDIUMJunos OS: QFX10K Series: Denial of Service (DoS) upon receipt of crafted MLD packets on multi-homing ESI in VXLANEPSS 0.3%CVE-2026-0241MEDIUMTrust Protection Foundation: Multiple Authorization Bypass VulnerabilitiesEPSS 0.3%CVE-2026-47216HIGHTypesense: Unauthenticated Denial of Service in the Typesense /multi_search EndpointEPSS 0.3%CVE-2025-52931HIGHUnexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence PluginEPSS 0.3%