Weaknesses of type CWE-754

508 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2021-0287MEDIUMJunos OS and Junos OS Evolved: RPD could crash in SR-ISIS/MPLS environment due to a flap of an ISIS link in the networkEPSS 0.4%CVE-2023-28910HIGHDisabled Abortion FlagEPSS 0.4%CVE-2025-52931HIGHUnexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence PluginEPSS 0.4%CVE-2026-21693HIGHiccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cppEPSS 0.4%CVE-2026-85014MEDIUMundici vulnerable to Denial of Service via WebSocketStream unclean closeEPSS 0.4%CVE-2026-13417MEDIUMBoards plugin denial of service via unvalidated block fields.propertiesEPSS 0.4%CVE-2024-7826—Unhandled exception vulnerability that can cause the WRSA.exe service to crash and generate a crash dumpEPSS 0.4%CVE-2026-116516MEDIUMInsufficient length validation when parsing Zoom chat transcriptionsEPSS 0.4%CVE-2025-53638MEDIUMSolady lacks extcodesize validation on implementation in ERC4337FactoryEPSS 0.4%CVE-2026-0262MEDIUMPAN-OS: Denial of Service Vulnerabilities in Network Traffic ParsingEPSS 0.4%CVE-2023-4828MEDIUMITM Server Communications HijackEPSS 0.4%CVE-2026-20719MEDIUMDoS via URL Previews Rendering Malicious SVGsEPSS 0.4%CVE-2026-113260HIGHImproper state validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UEPSS 0.4%CVE-2025-4663MEDIUMDenial-of-Service (DoS) after Unusual or Exceptional Conditions vulnerabilityEPSS 0.4%CVE-2026-66774LOWMultiple vulnerabilities in SAP Business AI Platform (Approuter)EPSS 0.4%CVE-2022-20804MEDIUMCisco Unified Communications Products Denial of Service VulnerabilityEPSS 0.4%CVE-2026-44317MEDIUMfree5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereferenceEPSS 0.4%CVE-2025-13080MEDIUMDrupal core - Moderately critical - Denial of Service - SA-CORE-2025-005EPSS 0.3%CVE-2026-46541HIGHNimiq network-libp2p: DHT query poisoning via first-record verification failureEPSS 0.3%CVE-2026-24513LOWingress-nginx auth-url protection bypassEPSS 0.3%