Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2025-58354MEDIUMKata Containers coco-tdx malicious host can circumvent initdata verificationEPSS 0.3%CVE-2024-47503HIGHJunos OS: SRX4600 and SRX5000 Series: Sequence of specific PIM packets causes a flowd crashEPSS 0.3%CVE-2026-73430MEDIUMRussh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)EPSS 0.3%CVE-2026-33790HIGHJunos OS: SRX Series: In a NAT64 configuration, receipt of a specific, malformed ICMPv6 packet will cause the srxpfe process to crash and restart.EPSS 0.3%CVE-2024-39535HIGHJunos OS Evolved: ACX 7000 Series: When specific traffic is received in a VPLS scenario evo-pfemand crashesEPSS 0.3%CVE-2023-52534MEDIUMIn ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote denial of service with no additioEPSS 0.3%CVE-2025-13080MEDIUMDrupal core - Moderately critical - Denial of Service - SA-CORE-2025-005EPSS 0.3%CVE-2025-22445LOWMisleading UI for undefined admin console settings in Calls causes security confusionEPSS 0.3%CVE-2026-40249MEDIUMfree5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errorsEPSS 0.3%CVE-2026-24513LOWingress-nginx auth-url protection bypassEPSS 0.3%CVE-2026-21689MEDIUMiccDEV has Type Confusion in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cppEPSS 0.3%CVE-2024-20506MEDIUMClamAV Privilege Handling Escalation VulnerabilityEPSS 0.3%CVE-2025-53638MEDIUMSolady lacks extcodesize validation on implementation in ERC4337FactoryEPSS 0.3%CVE-2025-0128HIGHPAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted PacketEPSS 0.3%CVE-2026-91733HIGHImproper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer processEPSS 0.3%CVE-2025-55035MEDIUMMattermost Desktop DoS when user has basic authentication server configuredEPSS 0.3%CVE-2024-39561MEDIUMJunos OS: SRX4600, SRX5000 Series: TCP packets with SYN/FIN or SYN/RST are transferred after enabling no-syn-check with Express PathEPSS 0.3%CVE-2026-42246HIGHnet-imap vulnerable to STARTTLS stripping via invalid response timingEPSS 0.3%CVE-2026-79072HIGHImproper state validation in Performance in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory insideEPSS 0.3%CVE-2025-10532MEDIUMIncorrect boundary conditions in the JavaScript: GC componentEPSS 0.3%