Weaknesses of type CWE-754

507 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2021-37862LOWMattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into EPSS 0.7%CVE-2023-4583HIGHBrowsing Context potentially not cleared when closing Private WindowEPSS 0.7%CVE-2023-52079MEDIUMConversion of property names to strings can trigger infinite recursionEPSS 0.7%CVE-2022-22227MEDIUMJunos OS Evolved: ACX7000 Series: Specific IPv6 transit traffic gets exceptioned to the routing-engine which causes increased CPU utilizationEPSS 0.7%CVE-2025-12387MEDIUMDenial of Service in Pix-Link LV-WR21QEPSS 0.7%CVE-2023-32726LOWPossible buffer overread from reading DNS responsesEPSS 0.7%CVE-2021-33605MEDIUMUnauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20EPSS 0.7%CVE-2025-54427MEDIUMPolkadot Frontier contains missing `check_inherent` for `note_min_gas_price_target` inflates gas priceEPSS 0.7%CVE-2021-31364MEDIUMJunos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is receivedEPSS 0.7%CVE-2026-73314HIGHXenForo < 2.3.13 Signature Verification Bypass via PayPal REST WebhookEPSS 0.7%CVE-2023-34099MEDIUMImproper mail validation in ShopwareEPSS 0.6%CVE-2023-49607MEDIUMPlaybook plugin crash via missing interface type assertionEPSS 0.6%CVE-2019-1849HIGHCisco IOS XR Software BGP MPLS-Based EVPN Denial of Service VulnerabilityEPSS 0.6%CVE-2023-44199HIGHJunos OS: MX Series: In a PTP scenario a prolonged routing protocol churn can trigger an FPC rebootEPSS 0.6%CVE-2023-36835HIGHJunos OS: QFX10000 Series: All traffic will be dropped after a specific valid IP packet has been received which needs to be routed over a VXLAN tunnelEPSS 0.6%CVE-2024-47499HIGHJunos OS and Junos OS Evolved: In a BMP scenario receipt of a malformed AS PATH attribute can cause an RPD crashEPSS 0.6%CVE-2023-22393HIGHJunos OS and Junos OS Evolved: RPD crash upon receipt of BGP route with invalid next-hop EPSS 0.6%CVE-2026-69185HIGHSocket.IO: Zero-attachment Memory ExhaustionEPSS 0.6%CVE-2026-33939HIGHHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationEPSS 0.6%CVE-2023-32716MEDIUMDenial of Service via the 'dump' SPL commandEPSS 0.6%