Fallos del tipo CWE-248

243 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2025-59538HIGHArgo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookEPSS 8.3%CVE-2021-37714HIGHCrafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptionsEPSS 6.9%CVE-2025-53366HIGHMCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of ServiceEPSS 6.0%CVE-2018-11466—A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versEPSS 4.0%CVE-2025-59465HIGHA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` erEPSS 3.6%CVE-2018-7852HIGHA CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium wEPSS 3.6%CVE-2020-6019—Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBaEPSS 2.8%CVE-2020-10604—In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through speciEPSS 2.1%CVE-2022-41940HIGHUncaught exception in engine.io EPSS 1.9%CVE-2018-11464—A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HFEPSS 1.9%CVE-2019-6809—A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions priorEPSS 1.8%CVE-2019-6575HIGHA vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUSEPSS 1.6%CVE-2022-24822HIGHDenial of Service in @podium/layout and @podium/proxyEPSS 1.6%CVE-2019-6829HIGHA CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prioEPSS 1.6%CVE-2020-15796—A vulnerability has been identified in SIMATIC ET 200SP Open Controller (incl. SIPLUS variants) (V20.8), SIMATIC S7-1500 Software ControllerEPSS 1.6%CVE-2019-6828—A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to VEPSS 1.5%CVE-2019-10931—A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet commuEPSS 1.5%CVE-2020-10292HIGHService DoS through arbitrary pointer dereferencing on KUKA simulatorEPSS 1.5%CVE-2022-31015MEDIUMUncaught Exception (due to a data race) leads to process termination in WaitressEPSS 1.4%CVE-2025-3891HIGHMod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabledEPSS 1.4%