Weaknesses of type CWE-754

508 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2023-25619HIGH A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller wEPSS 0.6%CVE-2024-37151MEDIUMSuricata defrag: IP ID reuse can lead to policy bypassEPSS 0.6%CVE-2024-8175HIGHCODESYS: web server vulnerable to DoSEPSS 0.6%CVE-2026-0287MEDIUMPAN-OS: Denial of Service Vulnerabilities in Network Traffic ProcessingEPSS 0.6%CVE-2026-67416MEDIUMRabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validationEPSS 0.6%CVE-2023-28976HIGHJunos OS: MX Series: If a specific traffic rate goes above the DDoS threshold it will lead to an FPC crashEPSS 0.6%CVE-2024-36128HIGHDirectus is soft-locked by providing a string value to random string utilEPSS 0.6%CVE-2026-73549MEDIUMEnvoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clustersEPSS 0.6%CVE-2023-48431MEDIUMA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correctly validate the respoEPSS 0.6%CVE-2023-5967MEDIUMDenial of Service via crashing the Calls PluginEPSS 0.6%CVE-2023-46765HIGHVulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability.EPSS 0.6%CVE-2024-34694HIGHLNbits improperly handles potential network and payment failures when using Eclair backendEPSS 0.6%CVE-2023-23602MEDIUMContent Security Policy wasn't being correctly applied to WebSockets in WebWorkersEPSS 0.6%CVE-2026-4707HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.6%CVE-2026-54775MEDIUMCoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.EPSS 0.6%CVE-2026-73430MEDIUMRussh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)EPSS 0.6%CVE-2026-100352HIGHkin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation PathEPSS 0.6%CVE-2025-24975HIGHFirebird Non-Authorized Access to Encrypted Database Using Execute Statement on ExternalEPSS 0.6%CVE-2026-31637CRITICALrxrpc: reject undecryptable rxkad response ticketsEPSS 0.6%CVE-2023-29198MEDIUMContext isolation bypass via nested unserializable return value in ElectronEPSS 0.6%