Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2021-29544LOWCHECK-fail in `QuantizeAndDequantizeV4Grad`EPSS 0.3%CVE-2024-20089HIGHIn wlan, there is a possible denial of service due to incorrect error handling. This could lead to remote denial of service with no additionEPSS 0.3%CVE-2023-28974HIGHJunos OS: MX Series: In a BBE scenario upon receipt of specific malformed packets from subscribers the process bbe-smgd will crashEPSS 0.3%CVE-2026-79073HIGHImproper state validation in Parser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code EPSS 0.3%CVE-2026-40094MEDIUMnimiq-blockchain: network-libp2p untrusted peer can crash address book via empty peer contact addressesEPSS 0.3%CVE-2025-4663MEDIUMDenial-of-Service (DoS) after Unusual or Exceptional Conditions vulnerabilityEPSS 0.3%CVE-2025-24161MEDIUMThe issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS SonoEPSS 0.3%CVE-2026-2801HIGHIncorrect boundary conditions in the JavaScript: WebAssembly componentEPSS 0.3%CVE-2023-21405MEDIUMDenial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communicationEPSS 0.3%CVE-2022-22238MEDIUMJunos OS and Junos OS Evolved: The rpd process will crash when a malformed incoming RESV message is processedEPSS 0.3%CVE-2025-54463MEDIUMUnexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence PluginEPSS 0.3%CVE-2024-10635MEDIUMEnterprise Protection S/MIME Opaque Signature Attachment Scanning BypassEPSS 0.3%CVE-2025-66357MEDIUMCHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. When the Video Download featEPSS 0.3%CVE-2026-3109LOWMissing timestamp validation in Zoom webhook handlerEPSS 0.3%CVE-2024-42411MEDIUMUser creation date manipulation in POST /api/v4/usersEPSS 0.3%CVE-2024-47507MEDIUMJunos OS and Junos OS Evolved: BGP update message containing aggregator attribute with an ASN value of zero (0) is acceptedEPSS 0.3%CVE-2025-41241MEDIUMDenial-of-service vulnerabilityEPSS 0.3%CVE-2026-41662MEDIUMAdmidio: Missing Minimum Administrator Check in Role Membership RemovalEPSS 0.3%CVE-2025-62605MEDIUMMastodon quotes control can be bypassedEPSS 0.3%CVE-2025-53514MEDIUMUnexpected Input to Server Webhook endpoint Causes DoS in Mattermost Confluence PluginEPSS 0.3%