Fallos del tipo CWE-248

291 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2024-0754MEDIUMSome WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122.EPSS 0.4%CVE-2026-55780LOWNanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry SizeEPSS 0.4%CVE-2025-59229MEDIUMMicrosoft Office Denial of Service VulnerabilityEPSS 0.4%CVE-2023-5038HIGHUnauthenticated DoSEPSS 0.4%CVE-2025-43855HIGHtRPC 11 WebSocket DoS VulnerabilityEPSS 0.4%CVE-2026-20068MEDIUMMultiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityEPSS 0.4%CVE-2026-20031MEDIUMClamAV CSS Image Parsing Error Handling Denial of Service VulnerabilityEPSS 0.4%CVE-2025-54134HIGHHAX CMS NodeJs's Improper Error Handling Leads to Denial of ServiceEPSS 0.4%CVE-2025-55553HIGHA syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).EPSS 0.4%CVE-2025-55557HIGHA Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of ServEPSS 0.4%CVE-2026-7183MEDIUMaligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exceptionEPSS 0.4%CVE-2025-9124HIGHRockwell Automation Compact GuardLogix® 5370 Denial-Of-Service VulnerabilityEPSS 0.4%CVE-2026-42268HIGHModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operatorsEPSS 0.4%CVE-2026-92081MEDIUMfastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responsesEPSS 0.4%CVE-2026-52739MEDIUMZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier RejectionEPSS 0.4%CVE-2026-19534HIGHundici vulnerable to Denial of Service via unrequested WebSocket subprotocolEPSS 0.4%CVE-2026-72813MEDIUMactix-files before 0.6.10 Denial of Service via empty Range headerEPSS 0.4%CVE-2025-36539HIGHAVEVA PI Data Archive Uncaught ExceptionEPSS 0.4%CVE-2023-1691—Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause featEPSS 0.4%CVE-2024-28835MEDIUMGnutls: potential crash during chain building/verificationEPSS 0.4%