Fallos del tipo CWE-248

291 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2026-33191HIGHfree5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server ErrorEPSS 0.4%CVE-2026-82254HIGHgitoxide before 0.69.0 Denial of Service via gix-packEPSS 0.4%CVE-2026-9509HIGHUncaught exception vulnerability in Suprema's BioStarEPSS 0.4%CVE-2026-37554HIGHAn issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists EPSS 0.4%CVE-2023-5310MEDIUMZ-Wave Denial of Service caused by Stream of PacketsEPSS 0.3%CVE-2026-92954CRITICALvm2 3.10.0 through 3.11.5 Denial of Service via Host PromiseEPSS 0.3%CVE-2026-45554MEDIUMNiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routesEPSS 0.3%CVE-2026-55484HIGHALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire serverEPSS 0.3%CVE-2024-52903MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2022-51009HIGHPocketMine-MP before 4.7.2 Denial of Service via Skin GeometryEPSS 0.3%CVE-2026-46545HIGHnimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed itemEPSS 0.3%CVE-2023-52342HIGHIn modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosuEPSS 0.3%CVE-2026-61666HIGHwebsocket-driver: Denial of service via malformed Host headerEPSS 0.3%CVE-2025-0657HIGHALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-rangeEPSS 0.3%CVE-2026-54553MEDIUMStarlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoSEPSS 0.3%CVE-2026-52856HIGHWings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceEPSS 0.3%CVE-2023-25526MEDIUMNVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exceEPSS 0.3%CVE-2026-34943MEDIUMWasmtime panics when lifting `flags` component valueEPSS 0.3%CVE-2026-42544HIGHGranian: Unauthenticated DoS via WebSocket subprotocol header panicEPSS 0.3%CVE-2024-49705MEDIUMXSS in iKSORISEPSS 0.3%