Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2021-33605MEDIUMUnauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20EPSS 0.7%CVE-2021-31364MEDIUMJunos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is receivedEPSS 0.7%CVE-2023-49607MEDIUMPlaybook plugin crash via missing interface type assertionEPSS 0.6%CVE-2023-34099MEDIUMImproper mail validation in ShopwareEPSS 0.6%CVE-2019-1849HIGHCisco IOS XR Software BGP MPLS-Based EVPN Denial of Service VulnerabilityEPSS 0.6%CVE-2024-47499HIGHJunos OS and Junos OS Evolved: In a BMP scenario receipt of a malformed AS PATH attribute can cause an RPD crashEPSS 0.6%CVE-2023-36835HIGHJunos OS: QFX10000 Series: All traffic will be dropped after a specific valid IP packet has been received which needs to be routed over a VXLAN tunnelEPSS 0.6%CVE-2025-12387MEDIUMDenial of Service in Pix-Link LV-WR21QEPSS 0.6%CVE-2022-22235MEDIUMJunos OS: SRX Series: A flowd core will be observed when malformed GPRS traffic is processedEPSS 0.6%CVE-2023-32716MEDIUMDenial of Service via the 'dump' SPL commandEPSS 0.6%CVE-2024-37151MEDIUMSuricata defrag: IP ID reuse can lead to policy bypassEPSS 0.6%CVE-2023-25619HIGH A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller wEPSS 0.6%CVE-2023-28976HIGHJunos OS: MX Series: If a specific traffic rate goes above the DDoS threshold it will lead to an FPC crashEPSS 0.6%CVE-2024-8175HIGHCODESYS: web server vulnerable to DoSEPSS 0.6%CVE-2026-0287MEDIUMPAN-OS: Denial of Service Vulnerabilities in Network Traffic ProcessingEPSS 0.6%CVE-2024-36128HIGHDirectus is soft-locked by providing a string value to random string utilEPSS 0.6%CVE-2023-48431MEDIUMA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correctly validate the respoEPSS 0.6%CVE-2023-22393HIGHJunos OS and Junos OS Evolved: RPD crash upon receipt of BGP route with invalid next-hop EPSS 0.6%CVE-2026-33939HIGHHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationEPSS 0.6%CVE-2022-22227MEDIUMJunos OS Evolved: ACX7000 Series: Specific IPv6 transit traffic gets exceptioned to the routing-engine which causes increased CPU utilizationEPSS 0.6%