Fallos del tipo CWE-248

291 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2023-39945HIGHMalformed serialized data in a data submessage leads to unhandled exceptionEPSS 0.9%CVE-2023-38504HIGHSails DoS vulnerability for apps with sockets enabledEPSS 0.9%CVE-2024-11172HIGHDenial of Service in danny-avila/librechatEPSS 0.9%CVE-2021-41545—A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXEPSS 0.9%CVE-2026-48069HIGH@grpc/grps-js: An incoming malformed compressed message can cause a client or server crashEPSS 0.9%CVE-2021-36802MEDIUMAkaunting DoS via User-Controlled 'locale' VariableEPSS 0.9%CVE-2026-2229HIGHundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits ValidationEPSS 0.9%CVE-2023-42444HIGHphonenumber panics on parsing crafted RF3966 inputsEPSS 0.9%CVE-2024-11173MEDIUMUnhandled Exception in danny-avila/librechatEPSS 0.9%CVE-2023-3405HIGHDenial of service condition in M-Files ServerEPSS 0.8%CVE-2025-23166HIGHThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background tEPSS 0.8%CVE-2020-14348—It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the user namespace puts AMEPSS 0.8%CVE-2025-47944HIGHMulter vulnerable to Denial of Service from maliciously crafted requestsEPSS 0.8%CVE-2026-59892HIGHOpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed headerEPSS 0.8%CVE-2025-20171HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%CVE-2022-39386HIGHfastify-websocket vulnerable to uncaught exception via crash on malformed packetEPSS 0.8%CVE-2023-4785HIGHDenial of Service in gRPC CoreEPSS 0.8%CVE-2023-46239HIGHquic-go vulnerable to pointer dereference that can lead to panicEPSS 0.8%CVE-2025-20172HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, EPSS 0.8%CVE-2025-20176HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%