Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2024-56777MEDIUMdrm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_checkEPSS 0.2%CVE-2024-35424MEDIUMvmir e8117 was discovered to contain a segmentation violation via the import_function function at /src/vmir_wasm_parser.c.EPSS 0.2%CVE-2026-65904LOWDOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE modeEPSS 0.2%CVE-2024-35421MEDIUMvmir e8117 was discovered to contain a segmentation violation via the wasm_parse_block function at /src/vmir_wasm_parser.c.EPSS 0.2%CVE-2025-3359MEDIUMGnuplot: segmentation fault via io_str_init_static_internal functionEPSS 0.2%CVE-2025-0112MEDIUMCortex XDR Agent: Local Windows User Can Disable the AgentEPSS 0.2%CVE-2025-4675HIGHImproper implementation of Modbus protocol leading to DOS attackEPSS 0.2%CVE-2022-29278HIGHIncorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory Incorrect pointer checks within the NvEPSS 0.2%CVE-2025-43715HIGHNullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation,EPSS 0.2%CVE-2025-71413MEDIUMIn CPDLC, Malformed or Out of Sequence Frames Can Cause ResetsEPSS 0.2%CVE-2022-47112LOW7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffecEPSS 0.2%CVE-2025-30258LOWIn GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incEPSS 0.2%CVE-2021-29531LOWCHECK-fail in tf.raw_ops.EncodePngEPSS 0.2%CVE-2021-29534LOWCHECK-fail in SparseConcatEPSS 0.2%CVE-2025-64704MEDIUMWebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instructionEPSS 0.2%CVE-2025-48581HIGHIn VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the code. This could leEPSS 0.2%CVE-2024-29979MEDIUMUnsafe Handling of Phoenix UEFI VariablesEPSS 0.2%CVE-2026-20747HIGHImproper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. NetwoEPSS 0.2%CVE-2025-71412HIGHIn CPDLC, False Emergency or Status Messages Will be Accepted as LegitimateEPSS 0.2%CVE-2022-26079MEDIUMImproper conditions check in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to poEPSS 0.2%