Weaknesses of type CWE-755

243 results

Tratamento inadequado de condições excepcionais

Ocorre quando o código falha em capturar, validar ou responder adequadamente a erros e situações anormais. O programa continua executando com estado inválido, ignorando sinais de falha do sistema ou bibliotecas, permitindo que bugs se propaguem e criem vulnerabilidades de segurança.

Example

Uma aplicação tenta abrir um arquivo sem verificar se a operação falhou; se o arquivo não existe, a variável fica nula, e acessá-la depois causa crash ou comportamento impredizível. Ou um banco de dados retorna erro, mas o código ignora e usa dados vazios como válidos.

How to mitigate

Sempre capture exceções e erros explicitamente — use try/catch, verifique códigos de retorno e valores nulos antes de usar. Registre falhas em logs, falhe de forma segura (recuse a operação) e nunca assuma que uma chamada de função funcionou sem comprovação.

CVE-2023-52075HIGHReVanced API vulnerable to Denial of Service due to lack of error cachingEPSS 0.5%CVE-2023-50212MEDIUMD-Link G416 httpd Improper Handling of Exceptional Conditions Information Disclosure VulnerabilityEPSS 0.5%CVE-2024-51744LOWBad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwtEPSS 0.5%CVE-2020-1681MEDIUMJunos OS Evolved: Receipt of a specifically malformed NDP packet could lead to Denial of ServiceEPSS 0.5%CVE-2024-39555HIGHJunos OS and Junos OS Evolved: Receipt of a specific malformed BGP update causes the session to resetEPSS 0.5%CVE-2024-39691MEDIUMMalicious Matrix homeserver can leak truncated message content of messages it shouldn't have access toEPSS 0.5%CVE-2024-51502MEDIUMPanic Vulnerability in loona-hpackEPSS 0.5%CVE-2024-21610MEDIUMJunos OS: If in a scaled CoS scenario information on CoS state is gathered mgd processes get stuckEPSS 0.5%CVE-2026-44902HIGHopentelemetry-js: Prometheus exporter process crash via malformed HTTP requestEPSS 0.5%CVE-2025-24478HIGH5380/5580 Denial-of-Service VulnerabilityEPSS 0.5%CVE-2025-59530HIGHquic-go has Client Crash Due to Premature HANDSHAKE_DONE FrameEPSS 0.5%CVE-2026-62994LOWCoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` pluginEPSS 0.5%CVE-2024-32000MEDIUMTruncated content of messages can be leaked from matrix-appservice-ircEPSS 0.5%CVE-2026-53496MEDIUMExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxesEPSS 0.5%CVE-2023-41332LOWDenial of service via Kubernetes annotations in specific Cilium configurationsEPSS 0.4%CVE-2023-42509MEDIUMJFrog Artifactory Sensitive Data Leakage in Repository configuration processEPSS 0.4%CVE-2025-52948HIGHJunos OS: Specific unknown traffic pattern causes FPC and system to crash when packet capturing is enabledEPSS 0.4%CVE-2026-42792MEDIUMepmd permanent DoS via EMFILE on accept(2) in ertsEPSS 0.4%CVE-2020-15701MEDIUMUnhandled exception in apportEPSS 0.4%CVE-2024-39525HIGHJunos OS and Junos OS Evolved: When BGP traceoptions is enabled, receipt of specially crafted BGP packet causes RPD crashEPSS 0.4%