Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2026-57031MEDIUMJunos OS: MX Series: For subscribers configured on static interfaces, input filters are not in effectEPSS 0.2%CVE-2023-38420LOWImproper conditions check in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable infEPSS 0.2%CVE-2026-66774LOWMultiple vulnerabilities in SAP Business AI Platform (Approuter)EPSS 0.2%CVE-2022-28793MEDIUMGiven the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT EPSS 0.2%CVE-2025-22848MEDIUMImproper conditions check for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentialEPSS 0.2%CVE-2021-29533LOWCHECK-fail in DrawBoundingBoxesEPSS 0.2%CVE-2024-56692HIGHf2fs: fix to do sanity check on node blkaddr in truncate_node()EPSS 0.2%CVE-2026-8491LOWNode View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034EPSS 0.2%CVE-2025-20625HIGHImproper conditions check for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.110.0.5 may allow an unauthenticatedEPSS 0.2%CVE-2026-13417MEDIUMBoards plugin denial of service via unvalidated block fields.propertiesEPSS 0.2%CVE-2024-56728MEDIUMocteontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.cEPSS 0.2%CVE-2024-9469MEDIUMCortex XDR Agent: Local Windows User Can Disable the AgentEPSS 0.2%CVE-2026-30960CRITICALRSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI InterfaceEPSS 0.2%CVE-2026-0944MEDIUMGroup invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001EPSS 0.2%CVE-2026-87532MEDIUMImproper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictEPSS 0.2%CVE-2024-56777MEDIUMdrm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_checkEPSS 0.2%CVE-2024-50196MEDIUMpinctrl: ocelot: fix system hang on level based interruptsEPSS 0.2%CVE-2026-42950MEDIUMELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page whileEPSS 0.2%CVE-2024-56776MEDIUMdrm/sti: avoid potential dereference of error pointersEPSS 0.2%CVE-2024-56778MEDIUMdrm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_checkEPSS 0.2%