Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2026-49316MEDIUMIndian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdownEPSS 0.2%CVE-2025-0129CRITICALPrisma Access Browser: Inappropriate control behavior in Prisma Access BrowserEPSS 0.2%CVE-2025-62875MEDIUMLocal DoS in OpenSMTPD via UNIX domain socket smtpd.sockEPSS 0.2%CVE-2024-10945HIGHFactoryTalk® Updater Local Privilege EscalationEPSS 0.2%CVE-2023-21102HIGHIn __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error in the code. This coEPSS 0.2%CVE-2026-20739HIGHImproper conditions check for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of seEPSS 0.2%CVE-2026-33774MEDIUMJunos OS: MX Series: Firewall filters on lo0.<non-0> in the default routing instance are not in effectEPSS 0.2%CVE-2023-38069LOWIn JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain casesEPSS 0.2%CVE-2024-2502LOWFailure to update the tamper reset cause register when a tamper event occursEPSS 0.2%CVE-2026-87656MEDIUMImproper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictEPSS 0.2%CVE-2026-4643LOWCalling window.close() from server-side content causes crash in the Mattermost Desktop AppEPSS 0.2%CVE-2026-35366MEDIUMuutils coreutils printenv Security Inspection Bypass via UTF-8 EnforcementEPSS 0.2%CVE-2024-54114MEDIUMOut-of-bounds access vulnerability in playback in the DASH module Impact: Successful exploitation of this vulnerability will affect availabiEPSS 0.2%CVE-2024-30384MEDIUMJunos OS: EX4300 Series: If a specific CLI command is issued PFE crashes will occurEPSS 0.2%CVE-2026-87645MEDIUMImproper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictEPSS 0.2%CVE-2026-59693MEDIUMA vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), DesEPSS 0.2%CVE-2025-20200MEDIUMA vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privilegEPSS 0.2%CVE-2026-33781HIGHJunos OS: EX Series, QFX Series: In a VXLAN scenario when specific control protocol packets are received, memory leaks and eventually no traffic is passedEPSS 0.2%CVE-2025-20201MEDIUMA vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privilegEPSS 0.2%CVE-2024-21806MEDIUMImproper conditions check in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before versionEPSS 0.2%