Fallos del tipo CWE-476

2571 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2009-2516HIGHThe kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly validaEPSS 1.3%CVE-2021-40750MEDIUMAdobe Bridge NULL Pointer Dereference could lead to Application denial-of-serviceEPSS 1.3%CVE-2021-40778MEDIUMAdobe Media Encoder Null Pointer Dereference Application denial-of-serviceEPSS 1.3%CVE-2026-83665HIGHWindows DHCP Server Denial of Service VulnerabilityEPSS 1.3%CVE-2021-34737MEDIUMCisco IOS XR Software DHCP Version 4 Server Denial of Service VulnerabilityEPSS 1.3%CVE-2011-1881HIGHwin32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows ServeEPSS 1.3%CVE-2021-44758HIGHHeimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID andEPSS 1.3%CVE-2022-43594MEDIUMMultiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. SpecEPSS 1.3%CVE-2021-0206HIGHJunos OS: NFX Series, SRX Series: PFE may crash upon receipt of specific packet when SSL Proxy is configured.EPSS 1.3%CVE-2019-1922MEDIUMCisco IP Phone 7800 and 8800 Series Session Initiation Protocol Denial of Service VulnerabilityEPSS 1.3%CVE-2019-14878MEDIUMIn the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate aEPSS 1.3%CVE-2023-28625HIGHmod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is suppliedEPSS 1.3%CVE-2022-43595MEDIUMMultiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. SpecEPSS 1.3%CVE-2023-1667—A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cauEPSS 1.3%CVE-2023-0122HIGHA NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-EPSS 1.3%CVE-2025-11846MEDIUMA null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9EPSS 1.3%CVE-2024-27405HIGHusb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBsEPSS 1.3%CVE-2019-14877MEDIUMIn the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocateEPSS 1.3%CVE-2019-14875MEDIUMIn the __multiply function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocEPSS 1.3%CVE-2022-2231HIGHNULL Pointer Dereference in vim/vimEPSS 1.3%