Weaknesses of type CWE-755

243 results

Tratamento inadequado de condições excepcionais

Ocorre quando o código falha em capturar, validar ou responder adequadamente a erros e situações anormais. O programa continua executando com estado inválido, ignorando sinais de falha do sistema ou bibliotecas, permitindo que bugs se propaguem e criem vulnerabilidades de segurança.

Example

Uma aplicação tenta abrir um arquivo sem verificar se a operação falhou; se o arquivo não existe, a variável fica nula, e acessá-la depois causa crash ou comportamento impredizível. Ou um banco de dados retorna erro, mas o código ignora e usa dados vazios como válidos.

How to mitigate

Sempre capture exceções e erros explicitamente — use try/catch, verifique códigos de retorno e valores nulos antes de usar. Registre falhas em logs, falhe de forma segura (recuse a operação) e nunca assuma que uma chamada de função funcionou sem comprovação.

CVE-2021-42145HIGHAn assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cEPSS 0.4%CVE-2026-89025HIGHHirschmann HiOS Switch Platform DoS via Malformed HTTP RequestEPSS 0.4%CVE-2026-53459CRITICALBambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpointsEPSS 0.4%CVE-2025-66622LOWmatrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event valuesEPSS 0.4%CVE-2026-27809MEDIUMpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gapsEPSS 0.4%CVE-2024-53984MEDIUMNanopb does not release memory on error return when using PB_DECODE_DELIMITEDEPSS 0.4%CVE-2026-25957MEDIUMCube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted requestEPSS 0.4%CVE-2026-44319HIGHfree5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)EPSS 0.4%CVE-2025-62711LOWWasmtime vulnerable to segfault when using component resourcesEPSS 0.4%CVE-2024-36112MEDIUMNautobot dynamic-group-members doesn't enforce permission restrictions on member objectsEPSS 0.4%CVE-2026-44325HIGHfree5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)EPSS 0.4%CVE-2023-25561MEDIUMLogin fail open on JAAS misconfiguration in DataHubEPSS 0.4%CVE-2023-1695—Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause featEPSS 0.4%CVE-2024-11863MEDIUMSCP-Firmware VulnerabilityEPSS 0.4%CVE-2023-1732MEDIUMImproper random reading in CIRCLEPSS 0.4%CVE-2026-59162MEDIUMExcelize: Negative shared-string index causes panic in GetCellValue and GetRowsEPSS 0.4%CVE-2021-0259HIGHJunos OS and Junos OS Evolved: QFX5K Series: Underlay network traffic might not be processed upon receipt of high rate of specific genuine overlay packets in VXLAN scenarioEPSS 0.4%CVE-2021-0290MEDIUMJunos OS: MX Series, EX9200 Series, SRX4600: Ethernet interface vulnerable to specially crafted framesEPSS 0.4%CVE-2024-9413HIGHThe transport_message_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing EPSS 0.4%CVE-2026-34065HIGHnimiq-primitives: Node crash due to missing interlink validation in election macro block proposalsEPSS 0.4%