Fallos del tipo CWE-252

130 resultados

Valor de retorno não verificado

Quando o código chama uma função mas não verifica se ela foi bem-sucedida (ignorando o valor de retorno), assume incorretamente que a operação funcionou. Isso deixa o programa em estado inconsistente e pode levar a falhas de segurança ou corrupção de dados.

Ejemplo

Um desenvolvedor abre um arquivo com `fopen()` mas não verifica se retornou NULL antes de usar o ponteiro. Se o arquivo não existir, o ponteiro inválido causará crash ou comportamento impredizível. Outro caso comum: chamar `chmod()` para mudar permissões sem verificar se falhou, deixando o arquivo com permissões erradas.

Cómo mitigar

Sempre verifique o retorno de funções críticas (I/O, alocação de memória, operações de sistema). Use análise estática para detectar returns ignorados. Em C, trate explicitamente erros com `if`, `goto` ou padrões como `defer`; em linguagens modernas, use exceções ou tipos `Result/Optional`.

CVE-2023-24825HIGHRIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_markEPSS 1.0%CVE-2026-56388CRITICALApache bRPC: Out-of-Bounds Write in Redis Command ParserEPSS 1.0%CVE-2021-37625HIGHIncorrect Check of Function Return Value in SkytableEPSS 0.9%CVE-2021-34585HIGHCODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)EPSS 0.9%CVE-2023-44322LOWA vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM EPSS 0.9%CVE-2022-38936HIGHAn issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wmessage.c:137.EPSS 0.9%CVE-2025-55146MEDIUMAn unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway beforEPSS 0.8%CVE-2024-37039MEDIUMCWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially craEPSS 0.8%CVE-2026-110353HIGHHAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncateEPSS 0.7%CVE-2026-11972HIGHtarfile opened in streaming mode mishandles EOFEPSS 0.7%CVE-2023-3247LOWMissing error check and insufficient random bytes in HTTP Digest authentication for SOAPEPSS 0.7%CVE-2026-22861HIGHiccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cppEPSS 0.7%CVE-2023-44182HIGHJunos OS and Junos OS Evolved: An Unchecked Return Value in multiple users interfaces affects confidentiality and integrity of device operationsEPSS 0.7%CVE-2026-121639CRITICALWatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of ServiceEPSS 0.7%CVE-2026-40092HIGHnimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHTEPSS 0.6%CVE-2025-58903LOWAn Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticatEPSS 0.6%CVE-2023-25733HIGHThe return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference.EPSS 0.6%CVE-2022-43763HIGHLack of checking preconditions in APROL EPSS 0.6%CVE-2022-43765HIGHDoS in APROLs Tbase serverEPSS 0.6%CVE-2024-42491MEDIUMA malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is usedEPSS 0.6%