Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2024-34694HIGHLNbits improperly handles potential network and payment failures when using Eclair backendEPSS 0.6%CVE-2023-23602MEDIUMContent Security Policy wasn't being correctly applied to WebSockets in WebWorkersEPSS 0.6%CVE-2026-54775MEDIUMCoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.EPSS 0.6%CVE-2022-22227MEDIUMJunos OS Evolved: ACX7000 Series: Specific IPv6 transit traffic gets exceptioned to the routing-engine which causes increased CPU utilizationEPSS 0.6%CVE-2023-29198MEDIUMContext isolation bypass via nested unserializable return value in ElectronEPSS 0.6%CVE-2026-23991MEDIUMgo-tuf affected by client DoS via malformed server responseEPSS 0.6%CVE-2020-5215MEDIUMSegmentation faultin TensorFlow when converting a Python string to tf.float16EPSS 0.6%CVE-2023-25620MEDIUM A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controllerEPSS 0.6%CVE-2024-40619HIGHRockwell Automation GuardLogix/ControlLogix 5580 Controller denial-of-service Vulnerability via Malformed Packet HandlingEPSS 0.6%CVE-2026-4707HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.6%CVE-2018-25007LOWUnauthorized client-side property update in UIDL request handler in Vaadin 10 and 11EPSS 0.6%CVE-2024-45085MEDIUMIBM WebSphere Application Server denial of serviceEPSS 0.6%CVE-2025-4619MEDIUMPAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted PacketsEPSS 0.6%CVE-2022-43393HIGHAn improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70EPSS 0.6%CVE-2022-3192MEDIUM Improper Check for Unusual or Exceptional ConditionsEPSS 0.6%CVE-2023-34348HIGHImproper Check or Handling of Exceptional Conditions in Aveva PI Server EPSS 0.6%CVE-2024-4182MEDIUMMattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom statEPSS 0.6%CVE-2025-54427MEDIUMPolkadot Frontier contains missing `check_inherent` for `note_min_gas_price_target` inflates gas priceEPSS 0.5%CVE-2025-32051MEDIUMLibsoup: segmentation fault when parsing malformed data uriEPSS 0.5%CVE-2024-50284HIGHksmbd: Fix the missing xa_store error checkEPSS 0.5%