Fallos del tipo CWE-390

30 resultados

Detecção de erro sem tratamento

O código detecta que algo deu errado (captura uma exceção, valida um retorno de erro, verifica uma condição anômala), mas não faz nada a respeito. Continua executando como se nada tivesse acontecido, deixando o programa em estado inconsistente ou processando dados inválidos.

Ejemplo

Um arquivo é aberto, o programador verifica se houve falha na abertura, mas ignora o resultado e tenta ler do descritor inválido; ou uma requisição HTTP retorna status 500, o código captura a exceção mas segue adiante e usa a resposta vazia, causando crashes ou comportamento indefinido.

Cómo mitigar

Sempre execute ação após detectar erro: lance exceção, faça log, retorne valor de erro ou interrompa o fluxo. Nunca deixe código executar silenciosamente após identificar falha. Revise blocos try-catch vazios e verificações de status que não têm consequência.

CVE-2024-30255MEDIUMHTTP/2: CPU exhaustion due to CONTINUATION frame floodEPSS 85.0%CVE-2024-27919HIGHHTTP/2: memory exhaustion due to CONTINUATION frame floodEPSS 83.9%CVE-2025-26465MEDIUMOpenssh: machine-in-the-middle attack if verifyhostkeydns is enabledEPSS 7.7%CVE-2019-5051HIGHAn exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handlerEPSS 4.0%CVE-2021-40391CRITICALAn out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and EPSS 3.0%CVE-2017-7485—In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL envirEPSS 2.0%CVE-2024-12086MEDIUMRsync: rsync server leaks arbitrary client filesEPSS 1.8%CVE-2026-43493CRITICALcrypto: pcrypt - Fix handling of MAY_BACKLOG requestsEPSS 0.7%CVE-2026-53434CRITICALApache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM ConnectorEPSS 0.6%CVE-2026-111823CRITICALMage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.EPSS 0.6%CVE-2026-114137HIGHDjango REST framework: TokenProxy.delete() reports success and revokes nothingEPSS 0.5%CVE-2024-20316MEDIUMA vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to accesEPSS 0.5%CVE-2026-85716LOWAsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verifiedEPSS 0.4%CVE-2025-25204MEDIUM`gh attestation verify` returns incorrect exit code during verification if no attestations are presentEPSS 0.4%CVE-2026-104480CRITICALImproper MLS Welcome roster validation in Discord libdave allows unauthorized group membershipEPSS 0.4%CVE-2024-11942MEDIUMDrupal core - Moderately critical - Improper error handling - SA-CORE-2024-002EPSS 0.4%CVE-2026-52989CRITICALnvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callersEPSS 0.4%CVE-2026-107275MEDIUM@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsedEPSS 0.3%CVE-2026-29810MEDIUMCyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.EPSS 0.3%CVE-2026-104002MEDIUMFail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)EPSS 0.3%