Fallos del tipo CWE-252

114 resultados

Valor de retorno não verificado

Quando o código chama uma função mas não verifica se ela foi bem-sucedida (ignorando o valor de retorno), assume incorretamente que a operação funcionou. Isso deixa o programa em estado inconsistente e pode levar a falhas de segurança ou corrupção de dados.

Ejemplo

Um desenvolvedor abre um arquivo com `fopen()` mas não verifica se retornou NULL antes de usar o ponteiro. Se o arquivo não existir, o ponteiro inválido causará crash ou comportamento impredizível. Outro caso comum: chamar `chmod()` para mudar permissões sem verificar se falhou, deixando o arquivo com permissões erradas.

Cómo mitigar

Sempre verifique o retorno de funções críticas (I/O, alocação de memória, operações de sistema). Use análise estática para detectar returns ignorados. Em C, trate explicitamente erros com `if`, `goto` ou padrões como `defer`; em linguagens modernas, use exceções ou tipos `Result/Optional`.

CVE-2021-34585HIGHCODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)EPSS 0.9%CVE-2023-44322LOWA vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM EPSS 0.9%CVE-2026-0723HIGHUnchecked Return Value in GitLabEPSS 0.9%CVE-2022-38936HIGHAn issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wmessage.c:137.EPSS 0.9%CVE-2025-55146MEDIUMAn unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway beforEPSS 0.8%CVE-2024-37039MEDIUMCWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially craEPSS 0.8%CVE-2023-3247LOWMissing error check and insufficient random bytes in HTTP Digest authentication for SOAPEPSS 0.7%CVE-2026-22861HIGHiccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cppEPSS 0.7%CVE-2026-40092HIGHnimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHTEPSS 0.6%CVE-2023-25733HIGHThe return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference.EPSS 0.6%CVE-2025-58903LOWAn Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticatEPSS 0.6%CVE-2022-43763HIGHLack of checking preconditions in APROL EPSS 0.6%CVE-2022-43765HIGHDoS in APROLs Tbase serverEPSS 0.6%CVE-2024-42491MEDIUMA malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is usedEPSS 0.6%CVE-2023-44182HIGHJunos OS and Junos OS Evolved: An Unchecked Return Value in multiple users interfaces affects confidentiality and integrity of device operationsEPSS 0.6%CVE-2024-1545MEDIUMFault Injection of RSA encryption in WolfCryptEPSS 0.6%CVE-2023-37902MEDIUMVyper's ecrecover can return undefined data if signature does not verifyEPSS 0.6%CVE-2026-14957HIGHFIPS mode assertion failure via malicious CERT payloadEPSS 0.6%CVE-2026-26080LOWHAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALEPSS 0.5%CVE-2024-38427HIGHIn International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTaEPSS 0.5%