Fallos del tipo CWE-248

379 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2026-54529MEDIUMSQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`EPSS 0.4%CVE-2026-114051HIGHvLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generateEPSS 0.4%CVE-2026-94642HIGHApache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exceptionEPSS 0.4%CVE-2024-58111HIGHException capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerabiliEPSS 0.4%CVE-2024-58112HIGHException capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerabiliEPSS 0.4%CVE-2026-100675HIGHstoatchat before 0.15.5 Denial of Service via mass mentionsEPSS 0.4%CVE-2022-20761HIGHCisco 1000 Series Connected Grid Router Integrated Wireless Access Point Denial of Service VulnerabilityEPSS 0.4%CVE-2026-33191HIGHfree5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server ErrorEPSS 0.4%CVE-2026-85014MEDIUMundici vulnerable to Denial of Service via WebSocketStream unclean closeEPSS 0.4%CVE-2026-110816MEDIUMqs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a stringEPSS 0.4%CVE-2023-26586MEDIUMUncaught exception for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenticatEPSS 0.4%CVE-2026-63341HIGHAedes has Uncaught Exception and Uncontrolled Resource ConsumptionEPSS 0.4%CVE-2026-102984HIGHAstro: Malformed port in the Host header can crash the Node adapterEPSS 0.4%CVE-2025-0657HIGHALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-rangeEPSS 0.4%CVE-2024-52903MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2026-86537HIGHApache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny serviceEPSS 0.4%CVE-2026-76493HIGHCisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception VulnerabilitiesEPSS 0.4%CVE-2026-88015MEDIUMrclone local: crafted Range request against a translated symlink panics (DoS)EPSS 0.4%CVE-2025-53620CRITICALCrashing any Qwik ServerEPSS 0.4%CVE-2026-107392MEDIUMmusic-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)EPSS 0.4%