Fallos del tipo CWE-248

379 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2026-27819HIGHVikunja has Path Traversal in CLI RestoreEPSS 0.8%CVE-2026-88099MEDIUMWindows Failover Cluster Denial of Service VulnerabilityEPSS 0.8%CVE-2025-23166HIGHThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background tEPSS 0.8%CVE-2025-47944HIGHMulter vulnerable to Denial of Service from maliciously crafted requestsEPSS 0.8%CVE-2025-7338HIGHMulter vulnerable to Denial of Service via unhandled exception from malformed requestEPSS 0.8%CVE-2020-14348—It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the user namespace puts AMEPSS 0.8%CVE-2025-20171HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%CVE-2023-4785HIGHDenial of Service in gRPC CoreEPSS 0.8%CVE-2025-20172HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, EPSS 0.8%CVE-2025-20173HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%CVE-2025-20176HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%CVE-2024-23325HIGHEnvoy crashes when using an address type that isn’t supported by the OSEPSS 0.8%CVE-2023-23932MEDIUMSpecially crafted RTPS message may cause an OpenDDS application to crashEPSS 0.7%CVE-2024-31217MEDIUM@strapi/plugin-upload has a Denial-of-Service via Improper Exception HandlingEPSS 0.7%CVE-2024-11738MEDIUMRustls: rustls network-reachable panic in `acceptor::accept`EPSS 0.7%CVE-2023-0158HIGHTriggered crash on direct RRDP accessEPSS 0.7%CVE-2022-38166HIGHIn F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler cEPSS 0.7%CVE-2023-0790HIGHUncaught Exception in thorsten/phpmyfaqEPSS 0.7%CVE-2026-64612HIGHLibcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed pngEPSS 0.7%CVE-2023-27318MEDIUMDenial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) EPSS 0.7%