Fallos del tipo CWE-476

2570 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2024-11650HIGHTenda i9 GetIPTV websReadEvent null pointer dereferenceEPSS 1.3%CVE-2023-45667MEDIUMNull pointer dereference because of an uninitialized variable in stb_imageEPSS 1.3%CVE-2023-6683MEDIUMQemu: vnc: null pointer dereference in qemu_clipboard_request()EPSS 1.3%CVE-2021-40742MEDIUMAdobe Audition NULL Pointer Dereference Application denial-of-serviceEPSS 1.3%CVE-2021-40737MEDIUMAdobe Audition NULL Pointer Dereference Application denial-of-serviceEPSS 1.3%CVE-2024-37826HIGHA NULL pointer dereference in vercot Serva v4.6.0 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.EPSS 1.2%CVE-2023-28484MEDIUMIn libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This ocEPSS 1.2%CVE-2020-35507—There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able EPSS 1.2%CVE-2025-14769HIGHipfw denial of serviceEPSS 1.2%CVE-2026-83648MEDIUMWindows Active Directory Domain Services Denial of Service VulnerabilityEPSS 1.2%CVE-2021-30500—Null pointer dereference was found in upx PackLinuxElf::canUnpack() in p_lx_elf.cpp,in version UPX 4.0.0. That allow attackers to execute arEPSS 1.2%CVE-2021-40774MEDIUMAdobe Prelude NULL Pointer Dereference Application Denial of ServiceEPSS 1.2%CVE-2021-40773MEDIUMAdobe Prelude NULL Pointer Dereference Application Denial of ServiceEPSS 1.2%CVE-2025-55698HIGHDirectX Graphics Kernel Denial of Service VulnerabilityEPSS 1.2%CVE-2024-33600MEDIUMnscd: Null pointer crashes after notfound responseEPSS 1.2%CVE-2025-5867HIGHRT-Thread lwp_syscall.c csys_sendto null pointer dereferenceEPSS 1.2%CVE-2024-32661HIGHFreeRDP rdp_write_logon_info_v1 NULL accessEPSS 1.2%CVE-2022-41860HIGHIn freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionariEPSS 1.2%CVE-2020-35495—There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cEPSS 1.2%CVE-2023-24818HIGHRIOT-OS vulnerable to null pointer dereference during fragment forwardingEPSS 1.2%