Fallos del tipo CWE-248

379 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2024-8249HIGHUnauthenticated Denial of Service (DoS) in mintplex-labs/anything-llmEPSS 0.7%CVE-2023-3774MEDIUMVault Enterprise Namespace Creation May Lead to Denial of ServiceEPSS 0.7%CVE-2025-24883HIGHgo-ethereum has a DoS via malicious p2p messageEPSS 0.7%CVE-2025-59466MEDIUMWe have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.creaEPSS 0.7%CVE-2024-23449MEDIUMElasticsearch Uncaught ExceptionEPSS 0.7%CVE-2024-43357HIGHJavaScript specification issue may lead to type confusion and pointer dereference in implementationsEPSS 0.7%CVE-2024-34363HIGHEnvoy can crash due to uncaught nlohmann JSON exceptionEPSS 0.7%CVE-2019-7474—A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloaEPSS 0.7%CVE-2023-22290MEDIUMUncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network accessEPSS 0.7%CVE-2026-34986HIGHGo JOSE affect by a panic in JWE decryptionEPSS 0.7%CVE-2026-73088HIGHBrowserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)EPSS 0.7%CVE-2026-59162MEDIUMExcelize: Negative shared-string index causes panic in GetCellValue and GetRowsEPSS 0.7%CVE-2024-58368HIGHSurrealDB before 1.1.0 Denial of Service via HTTP HeadersEPSS 0.7%CVE-2025-20637HIGHIn network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional EPSS 0.6%CVE-2024-8020HIGHDenial of Service in lightning-ai/pytorch-lightningEPSS 0.6%CVE-2026-84445HIGHgRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS serversEPSS 0.6%CVE-2026-33939HIGHHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationEPSS 0.6%CVE-2026-94622HIGHvLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer MetadataEPSS 0.6%CVE-2023-42447HIGHblurhash panics on parsing crafted inputsEPSS 0.6%CVE-2026-67416MEDIUMRabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validationEPSS 0.6%