Fallos del tipo CWE-248

379 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2026-59892HIGHOpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed headerEPSS 0.6%CVE-2025-35436MEDIUMCISA Thorium account verification email error handlingEPSS 0.6%CVE-2025-47281HIGHKyverno's Improper JMESPath Variable Evaluation Leads to Denial of ServiceEPSS 0.6%CVE-2025-71391HIGHSurrealDB before 2.2.2 Denial of Service via /sql endpointEPSS 0.6%CVE-2025-20664HIGHIn wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) inEPSS 0.5%CVE-2025-20663HIGHIn wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) inEPSS 0.5%CVE-2025-59462MEDIUMDenial-of-service (DoS) via delayed or missing client responseEPSS 0.5%CVE-2025-20758MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.5%CVE-2026-54908MEDIUMPion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange messageEPSS 0.5%CVE-2026-42270HIGHcountly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream ExceptionEPSS 0.5%CVE-2025-0648MEDIUMM-Files Server crash via EOT database driver configurationEPSS 0.5%CVE-2026-52731MEDIUMZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplateEPSS 0.5%CVE-2022-51014HIGHPocketMine-MP before 4.0.7 Denial of Service via JSON DecodingEPSS 0.5%CVE-2025-20753MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.5%CVE-2025-20754MEDIUMIn Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connecEPSS 0.5%CVE-2026-33203HIGHSiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive BypassEPSS 0.5%CVE-2023-29520MEDIUMPage render failure due to broken translations in xwiki-platformEPSS 0.5%CVE-2026-84994HIGHQwik: Crashing any Qwik Server via Resource thenableEPSS 0.5%CVE-2026-48038MEDIUMjoi: Uncaught RangeError on deeply nested input through recursive `link()` schemasEPSS 0.5%CVE-2026-72660MEDIUMUncaught Exception in Kibana Leading to Denial of ServiceEPSS 0.5%