Fallos del tipo CWE-248

381 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2021-3038MEDIUMGlobalProtect App: Windows VPN kernel driver denial of service (DoS)EPSS 0.2%CVE-2023-23774HIGHMotorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt onEPSS 0.2%CVE-2026-89316MEDIUMLoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertionEPSS 0.2%CVE-2026-44905HIGHVanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic VerificationEPSS 0.2%CVE-2021-33145HIGHUncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged usEPSS 0.2%CVE-2026-84947LOWundici vulnerable to response truncation via oversized chunked responses in the dump interceptorEPSS 0.2%CVE-2025-20054MEDIUMUncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable deniaEPSS 0.2%CVE-2026-87018HIGHundici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationEPSS 0.2%CVE-2026-43988HIGHVanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER ParsingEPSS 0.2%CVE-2026-102511HIGHApache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from themEPSS 0.2%CVE-2024-29076MEDIUMUncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of sEPSS 0.2%CVE-2025-8870MEDIUMOn affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.EPSS 0.2%CVE-2026-55244MEDIUMASTEVAL: Sandbox Escape via BaseException SubclassesEPSS 0.2%CVE-2024-32995MEDIUMDenial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.2%CVE-2026-45676MEDIUMOpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agentEPSS 0.2%CVE-2026-101175MEDIUMNull pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.2%CVE-2026-96274HIGHUncaught exception in Baicells Nova 430HEPSS 0.2%CVE-2026-12067—AvastSvc denial of service via unhandled JsonCpp exceptions in native message handlersEPSS 0.2%CVE-2026-80303—Avast WFP stream parser integer underflow causes system crashEPSS 0.2%CVE-2024-33848MEDIUMUncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of servicEPSS 0.1%