Weaknesses of type CWE-754

507 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2019-6811—An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earliEPSS 1.3%CVE-2019-0068MEDIUMJunos OS: SRX Series: Denial of Service vulnerability in flowd due to multicast packetsEPSS 1.3%CVE-2023-23931MEDIUMCipher.update_into can corrupt memory in pyca cryptographyEPSS 1.3%CVE-2020-7538—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now UnEPSS 1.3%CVE-2020-15202CRITICALInteger truncation in Shard API usageEPSS 1.3%CVE-2021-32780HIGHIncorrect handling of H/2 GOAWAY followed by SETTINGS framesEPSS 1.2%CVE-2022-24880MEDIUMPotential Captcha Validate Bypass in flask-session-captchaEPSS 1.2%CVE-2020-7539—A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers ModiconEPSS 1.2%CVE-2023-37899HIGHfeathersjs socket handler allows abusing implicit toStringEPSS 1.2%CVE-2020-5420HIGHGorouter is vulnerable to DoS attack via invalid HTTP responsesEPSS 1.2%CVE-2022-37392MEDIUMApache Traffic Server: Improperly reading the client requestsEPSS 1.2%CVE-2022-45788HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of seEPSS 1.2%CVE-2020-7536—A CWE-754:Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M340 CPUs (BMXP34* versions prior to V3.30) MEPSS 1.2%CVE-2020-27274—Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to closEPSS 1.2%CVE-2024-23650MEDIUMBuildKit possible panic when incorrect parameters sent from frontendEPSS 1.1%CVE-2019-6819HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when speEPSS 1.1%CVE-2024-50602MEDIUMAn issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspEPSS 1.1%CVE-2020-16125HIGHgdm3 would start gnome-initial-setup if it cannot contact accountserviceEPSS 1.1%CVE-2020-7549HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers ModicoEPSS 1.1%CVE-2020-3449MEDIUMCisco IOS XR Software Additional Paths Denial of Service VulnerabilityEPSS 1.1%