Fallos del tipo CWE-248

291 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2025-20176HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%CVE-2023-46135MEDIUMPanic in SignedPayload::from_payloadEPSS 0.8%CVE-2024-23325HIGHEnvoy crashes when using an address type that isn’t supported by the OSEPSS 0.8%CVE-2026-27819HIGHVikunja has Path Traversal in CLI RestoreEPSS 0.7%CVE-2023-23932MEDIUMSpecially crafted RTPS message may cause an OpenDDS application to crashEPSS 0.7%CVE-2024-31217MEDIUM@strapi/plugin-upload has a Denial-of-Service via Improper Exception HandlingEPSS 0.7%CVE-2024-11738MEDIUMRustls: rustls network-reachable panic in `acceptor::accept`EPSS 0.7%CVE-2023-0790HIGHUncaught Exception in thorsten/phpmyfaqEPSS 0.7%CVE-2025-7338HIGHMulter vulnerable to Denial of Service via unhandled exception from malformed requestEPSS 0.7%CVE-2023-0158HIGHTriggered crash on direct RRDP accessEPSS 0.7%CVE-2023-27318MEDIUMDenial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) EPSS 0.7%CVE-2025-24883HIGHgo-ethereum has a DoS via malicious p2p messageEPSS 0.7%CVE-2023-3774MEDIUMVault Enterprise Namespace Creation May Lead to Denial of ServiceEPSS 0.7%CVE-2025-59466MEDIUMWe have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.creaEPSS 0.7%CVE-2026-84445HIGHgRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS serversEPSS 0.7%CVE-2024-23449MEDIUMElasticsearch Uncaught ExceptionEPSS 0.7%CVE-2024-43357HIGHJavaScript specification issue may lead to type confusion and pointer dereference in implementationsEPSS 0.7%CVE-2024-8249HIGHUnauthenticated Denial of Service (DoS) in mintplex-labs/anything-llmEPSS 0.7%CVE-2022-38166HIGHIn F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler cEPSS 0.7%CVE-2024-34363HIGHEnvoy can crash due to uncaught nlohmann JSON exceptionEPSS 0.7%