Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2024-22422HIGHUnauthenticated Denial of Service (DOS) attack in AnythingLLMEPSS 1.0%CVE-2021-22285HIGHSECURITY – Denial of Service Vulnerabilities in SPIET800 INFI-Net to Ethernet Transfer module and PNI800 S+ Ethernet communication interface moduleEPSS 1.0%CVE-2024-50602MEDIUMAn issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspEPSS 1.0%CVE-2026-31790HIGHIncorrect Failure Handling in RSA KEM RSASVE EncapsulationEPSS 1.0%CVE-2021-31351HIGHJunos OS: MX Series: Receipt of specific packet on MS-MPC/MS-MIC causes line card resetEPSS 1.0%CVE-2022-22194HIGHJunos OS Evolved: PTX series: An attacker sending a crafted GRE packet will cause the PFE to restartEPSS 1.0%CVE-2022-23572MEDIUMCrash when type cannot be specialized in TensorflowEPSS 1.0%CVE-2022-24321—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADEPSS 1.0%CVE-2021-42020HIGHA vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,EPSS 1.0%CVE-2022-23590MEDIUMCrash due to erroneous `StatusOr` in TensorflowEPSS 1.0%CVE-2022-22185HIGHJunos OS: SRX Series: Denial of service vulnerability in flowd daemon upon receipt of a specific fragmented packetEPSS 1.0%CVE-2023-34449MEDIUMink! vulnerable to incorrect decoding of storage value when using `DelegateCall`EPSS 1.0%CVE-2024-23650MEDIUMBuildKit possible panic when incorrect parameters sent from frontendEPSS 1.0%CVE-2023-37303—An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails aftEPSS 1.0%CVE-2021-0282HIGHJunos OS: RPD crash while processing a specific BGP UPDATE when Multipath or add-path features are enabledEPSS 0.9%CVE-2023-48696MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-20837HIGHCisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service VulnerabilityEPSS 0.9%CVE-2025-33201HIGHNVIDIA Triton Inference Server contains a vulnerability where an attacker may cause an improper check for unusual or exceptional conditions EPSS 0.9%CVE-2023-48698MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-22180HIGHJunos OS: EX2300 Series, EX2300-MP Series, EX3400 Series: A slow memory leak due to processing of specific IPv6 packetsEPSS 0.9%