Weaknesses of type CWE-754

461 results

Falta de tratamento de condições excepcionais

O código não valida ou valida incorretamente situações anormais que raramente ocorrem durante a operação normal do sistema. Isso deixa o software vulnerável quando essas condições inesperadas finalmente acontecem — erros silenciosos, comportamentos indefinidos ou falhas de segurança podem ser explorados ou danificar a aplicação.

Example

Um servidor web processa uploads e assume que a pasta temporária sempre terá espaço disponível, sem checar se o disco está cheio. Quando o espaço acaba, o código falha silenciosamente, deixando requisições pendentes ou corrompidas, ou causando denial of service.

How to mitigate

Implemente validações explícitas para cenários fora do caminho feliz: verificar retornos de erro de chamadas de sistema (create, malloc, fopen), definir timeouts, validar limites de recursos e registrar falhas excepcionais com logging adequado. Trate toda exceção esperada, mesmo que rara.

CVE-2023-44199HIGHJunos OS: MX Series: In a PTP scenario a prolonged routing protocol churn can trigger an FPC rebootEPSS 0.5%CVE-2023-45922MEDIUMglx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is dispEPSS 0.5%CVE-2025-13392HIGHImproper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3EPSS 0.5%CVE-2026-0229MEDIUMPAN-OS: Denial of Service in Advanced DNS Security FeatureEPSS 0.5%CVE-2026-22796MEDIUMASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() functionEPSS 0.5%CVE-2024-30402HIGHJunos OS and Junos OS Evolved: The l2ald crashes on receiving telemetry messages from a specific subscriptionEPSS 0.5%CVE-2024-9124HIGHRockwell Automation PowerFlex 6000T CIP Security denial-of-service VulnerabilityEPSS 0.5%CVE-2025-24975HIGHFirebird Non-Authorized Access to Encrypted Database Using Execute Statement on ExternalEPSS 0.5%CVE-2023-44099—Vulnerability of data verification errors in the kernel module. Successful exploitation of this vulnerability may cause WLAN interruption.EPSS 0.5%CVE-2023-46765HIGHVulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability.EPSS 0.5%CVE-2026-33151HIGHsocket.io allows an unbounded number of binary attachmentsEPSS 0.5%CVE-2023-5967MEDIUMDenial of Service via crashing the Calls PluginEPSS 0.5%CVE-2024-21603MEDIUMJunos OS: MX Series: Gathering statistics in a scaled SCU/DCU configuration will lead to a device crashEPSS 0.5%CVE-2026-56812MEDIUMPhoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiffEPSS 0.5%CVE-2026-69185HIGHSocket.IO: Zero-attachment Memory ExhaustionEPSS 0.5%CVE-2024-21586HIGHJunos OS: SRX Series and NFX Series: Specific valid traffic leads to a PFE crashEPSS 0.5%CVE-2021-44856MEDIUMAn issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be crEPSS 0.5%CVE-2021-33139MEDIUMImproper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 mayEPSS 0.5%CVE-2024-39545HIGHJunos OS: SRX Series, MX Series with SPC3 and NFX350: When VPN tunnels parameters are not configured in specific way the iked process will crashEPSS 0.5%CVE-2024-39540HIGHJunos OS: SRX Series, and MX Series with SPC3: Specific valid TCP traffic can cause a pfe crashEPSS 0.5%