Fallos del tipo CWE-248

367 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2024-31904MEDIUMIBM App Connect Enterprise denial of serviceEPSS 0.5%CVE-2026-52739MEDIUMZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier RejectionEPSS 0.5%CVE-2026-63747HIGHSurrealDB before 3.1.0 Denial of Service via malformed RPC useEPSS 0.5%CVE-2026-100347MEDIUMkin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static pathEPSS 0.5%CVE-2024-3052HIGHZ/IP Gateway S2 Nonce Get Denial of Service VulnerabilityEPSS 0.5%CVE-2026-1528HIGHundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the clientEPSS 0.5%CVE-2025-48943MEDIUMvLLM allows clients to crash the openai server with invalid regexEPSS 0.5%CVE-2025-20758MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.5%CVE-2026-53496MEDIUMExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxesEPSS 0.5%CVE-2026-12644MEDIUMVersions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.protoEPSS 0.5%CVE-2026-52738MEDIUMZEBRA: Finalized address balance credit-first overflow on consensus-valid blocksEPSS 0.5%CVE-2025-29785HIGHquic-go Has Panic in Path Probe Loss Recovery HandlingEPSS 0.5%CVE-2026-23938LOWServer DoS via JavaScript preprocessing or script itemsEPSS 0.5%CVE-2026-14181HIGH@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded pathsEPSS 0.5%CVE-2026-65410HIGHThe issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, mEPSS 0.5%CVE-2024-51750MEDIUMElement allows a malicious homeserver can modify events leading to unrenderable events or roomsEPSS 0.5%CVE-2025-20754MEDIUMIn Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connecEPSS 0.5%CVE-2025-20753MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.5%CVE-2024-21983MEDIUMDenial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) EPSS 0.5%CVE-2026-106122MEDIUMRabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumersEPSS 0.5%