Fallos del tipo CWE-390

19 resultados

Detecção de erro sem tratamento

O código detecta que algo deu errado (captura uma exceção, valida um retorno de erro, verifica uma condição anômala), mas não faz nada a respeito. Continua executando como se nada tivesse acontecido, deixando o programa em estado inconsistente ou processando dados inválidos.

Ejemplo

Um arquivo é aberto, o programador verifica se houve falha na abertura, mas ignora o resultado e tenta ler do descritor inválido; ou uma requisição HTTP retorna status 500, o código captura a exceção mas segue adiante e usa a resposta vazia, causando crashes ou comportamento indefinido.

Cómo mitigar

Sempre execute ação após detectar erro: lance exceção, faça log, retorne valor de erro ou interrompa o fluxo. Nunca deixe código executar silenciosamente após identificar falha. Revise blocos try-catch vazios e verificações de status que não têm consequência.

CVE-2024-30255MEDIUMHTTP/2: CPU exhaustion due to CONTINUATION frame floodEPSS 87.8%CVE-2024-27919HIGHHTTP/2: memory exhaustion due to CONTINUATION frame floodEPSS 86.7%CVE-2025-26465MEDIUMOpenssh: machine-in-the-middle attack if verifyhostkeydns is enabledEPSS 7.4%CVE-2019-5051HIGHAn exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handlerEPSS 4.0%CVE-2021-40391CRITICALAn out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and EPSS 2.9%CVE-2017-7485—In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL envirEPSS 2.0%CVE-2024-12086MEDIUMRsync: rsync server leaks arbitrary client filesEPSS 1.8%CVE-2026-53434CRITICALApache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM ConnectorEPSS 0.5%CVE-2024-20316MEDIUMA vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to accesEPSS 0.5%CVE-2025-25204MEDIUM`gh attestation verify` returns incorrect exit code during verification if no attestations are presentEPSS 0.4%CVE-2024-11942MEDIUMDrupal core - Moderately critical - Improper error handling - SA-CORE-2024-002EPSS 0.4%CVE-2026-52989CRITICALnvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callersEPSS 0.3%CVE-2025-46367HIGHDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. EPSS 0.1%CVE-2026-48792MEDIUMpam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root executionEPSS 0.1%CVE-2025-0029LOWImproper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writeEPSS 0.1%CVE-2026-44310MEDIUMgitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callersEPSS 0.1%CVE-2026-59845MEDIUMLibssh: libssh: denial of service via unchecked proxycommand fork() failureEPSS 0.1%CVE-2024-49841HIGHDetection of Error Condition Without Action in HypervisorEPSS 0.1%CVE-2025-27039MEDIUMDetection of Error Condition Without Action in Computer VisionEPSS 0.1%