Weaknesses of type CWE-754

507 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2021-39162HIGHIncorrect handling of H2 GOAWAY + SETTINGS framesEPSS 1.6%CVE-2019-6857HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, ModiconEPSS 1.6%CVE-2019-6856HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, ModiconEPSS 1.6%CVE-2021-43801HIGHUncaught Exception in mercuriusEPSS 1.6%CVE-2021-1446HIGHCisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service VulnerabilityEPSS 1.5%CVE-2022-31103HIGHImproper handling of CSS at-rules in lettersanitizerEPSS 1.5%CVE-2020-24677HIGHInsecure Web Service in Symphony PlusEPSS 1.4%CVE-2026-39929HIGHLakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDPEPSS 1.4%CVE-2020-3480HIGHCisco IOS XE Software Zone-Based Firewall Denial of Service VulnerabilitiesEPSS 1.4%CVE-2019-6831—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmwaEPSS 1.4%CVE-2020-7537—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers ModicEPSS 1.4%CVE-2018-7794HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, ModiconEPSS 1.4%CVE-2022-32749HIGHApache Traffic Server: Improperly handled requests can cause crashes in specific pluginsEPSS 1.4%CVE-2020-7542—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers ModicEPSS 1.3%CVE-2020-7543—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers ModicEPSS 1.3%CVE-2020-1999MEDIUMPAN-OS: Threat signatures are evaded by specifically crafted packetsEPSS 1.3%CVE-2020-7477HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module 140NOE771x1 (VersionEPSS 1.3%CVE-2017-20166CRITICALEcto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.EPSS 1.3%CVE-2025-24224HIGHThe issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.9, macOS Sequoia 15.5, macOS VentEPSS 1.3%CVE-2019-15989HIGHCisco IOS XR Software Border Gateway Protocol Attribute Denial of Service VulnerabilityEPSS 1.3%