Fallos del tipo CWE-252

130 resultados

Valor de retorno não verificado

Quando o código chama uma função mas não verifica se ela foi bem-sucedida (ignorando o valor de retorno), assume incorretamente que a operação funcionou. Isso deixa o programa em estado inconsistente e pode levar a falhas de segurança ou corrupção de dados.

Ejemplo

Um desenvolvedor abre um arquivo com `fopen()` mas não verifica se retornou NULL antes de usar o ponteiro. Se o arquivo não existir, o ponteiro inválido causará crash ou comportamento impredizível. Outro caso comum: chamar `chmod()` para mudar permissões sem verificar se falhou, deixando o arquivo com permissões erradas.

Cómo mitigar

Sempre verifique o retorno de funções críticas (I/O, alocação de memória, operações de sistema). Use análise estática para detectar returns ignorados. Em C, trate explicitamente erros com `if`, `goto` ou padrões como `defer`; em linguagens modernas, use exceções ou tipos `Result/Optional`.

CVE-2026-106436MEDIUMApplication denial of service and data truncation via unchecked BSON append failures in MongoDB PHP DriverEPSS 0.3%CVE-2020-8934MEDIUMSite Kit by Google plugin for WordPressEPSS 0.2%CVE-2023-26591LOWUnchecked return value in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potenEPSS 0.2%CVE-2022-3108MEDIUMAn issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check EPSS 0.2%CVE-2023-47480HIGHAn issue in Pure Data 0.54-0 and fixed in 0.54-1 allows a local attacker to escalate privileges via the set*id () function.EPSS 0.2%CVE-2023-40067MEDIUMUnchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege viEPSS 0.2%CVE-2026-85649HIGH(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root uEPSS 0.2%CVE-2026-21492MEDIUMiccDEV ToneMap Writer has NULL Pointer Member CallEPSS 0.2%CVE-2024-39492HIGHmailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdownEPSS 0.2%CVE-2026-90648HIGHwasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table fliEPSS 0.2%CVE-2026-21498MEDIUMNULL Pointer Dereference in iccDEV XML Calculator ParserEPSS 0.2%CVE-2026-21502MEDIUMNULL Pointer Dereference in iccDEV XML Tag ParserEPSS 0.2%CVE-2026-21497MEDIUMNULL Pointer Dereference in iccDEV Unknown Tag ParserEPSS 0.2%CVE-2026-21496MEDIUMNULL Pointer Dereference in iccDEV Signature ParserEPSS 0.2%CVE-2023-29243MEDIUMUnchecked return value in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow a priviledgeEPSS 0.2%CVE-2023-4162MEDIUMSegmentation fault in Brocade Fabric OS after Brocade Fabric OS v9.0EPSS 0.2%CVE-2026-86141LOWxmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculateEPSS 0.2%CVE-2026-0421HIGHA potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in EPSS 0.2%CVE-2026-78699HIGHrename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgresEPSS 0.2%CVE-2022-46897MEDIUMAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The CapsuleIFWUSmm driver does not check the return value from a meEPSS 0.2%