Weaknesses of type CWE-754

508 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2026-22796MEDIUMASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() functionEPSS 0.6%CVE-2020-5215MEDIUMSegmentation faultin TensorFlow when converting a Python string to tf.float16EPSS 0.6%CVE-2023-25620MEDIUM A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controllerEPSS 0.6%CVE-2025-4619MEDIUMPAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted PacketsEPSS 0.6%CVE-2022-43393HIGHAn improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70EPSS 0.6%CVE-2026-23991MEDIUMgo-tuf affected by client DoS via malformed server responseEPSS 0.6%CVE-2024-40619HIGHRockwell Automation GuardLogix/ControlLogix 5580 Controller denial-of-service Vulnerability via Malformed Packet HandlingEPSS 0.6%CVE-2024-26008MEDIUMAn improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, ForEPSS 0.6%CVE-2018-25007LOWUnauthorized client-side property update in UIDL request handler in Vaadin 10 and 11EPSS 0.6%CVE-2026-0229MEDIUMPAN-OS: Denial of Service in Advanced DNS Security FeatureEPSS 0.6%CVE-2025-32051MEDIUMLibsoup: segmentation fault when parsing malformed data uriEPSS 0.6%CVE-2024-45085MEDIUMIBM WebSphere Application Server denial of serviceEPSS 0.6%CVE-2022-3192MEDIUM Improper Check for Unusual or Exceptional ConditionsEPSS 0.6%CVE-2023-34348HIGHImproper Check or Handling of Exceptional Conditions in Aveva PI Server EPSS 0.6%CVE-2026-20776HIGHImproper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. NetwoEPSS 0.6%CVE-2024-4182MEDIUMMattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom statEPSS 0.6%CVE-2024-50284HIGHksmbd: Fix the missing xa_store error checkEPSS 0.5%CVE-2023-45922MEDIUMglx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is dispEPSS 0.5%CVE-2026-33151HIGHsocket.io allows an unbounded number of binary attachmentsEPSS 0.5%CVE-2025-13392HIGHImproper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3EPSS 0.5%