Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2026-66303MEDIUMSkype for Business and Lync Denial of Service VulnerabilityEPSS 1.1%CVE-2026-59138MEDIUMMicrosoft Remote Registry Service Denial of Service VulnerabilityEPSS 1.1%CVE-2026-62762MEDIUMWindows Active Directory Domain Services Denial of Service VulnerabilityEPSS 1.1%CVE-2026-56168MEDIUMWindows SMB Server Denial of Service VulnerabilityEPSS 1.1%CVE-2026-84017HIGHWindows Routing and Remote Access Service (RRAS) Denial of Service VulnerabilityEPSS 1.1%CVE-2023-3316MEDIUMA NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.EPSS 1.1%CVE-2025-6491MEDIUMNULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace PrefixEPSS 1.1%CVE-2024-50608HIGHAn issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and porEPSS 1.1%CVE-2024-50609HIGHAn issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one canEPSS 1.1%CVE-2022-24809MEDIUMnet-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereferenceEPSS 1.1%CVE-2021-33717—A vulnerability has been identified in JT2Go (All versions < V13.2.0.1), Teamcenter Visualization (All versions < V13.2.0.1). When parsing sEPSS 1.1%CVE-2020-1656HIGHJunos OS: When a DHCPv6 Relay-Agent is configured upon receipt of a specific DHCPv6 client message, Remote Code Execution may occur.EPSS 1.1%CVE-2022-23589MEDIUMNull pointer dereference in Grappler's `IsConstant` in TensorflowEPSS 1.1%CVE-2024-47542MEDIUMGHSL-2024-235: GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereferenceEPSS 1.1%CVE-2023-46427CRITICALAn issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial EPSS 1.1%CVE-2021-23191—A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() in image.cxx may resuEPSS 1.1%CVE-2021-26927—A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of servEPSS 1.1%CVE-2017-7511—poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents.EPSS 1.1%CVE-2025-7797MEDIUMGPAC dash_client.c gf_dash_download_init_segment null pointer dereferenceEPSS 1.1%CVE-2024-47544MEDIUMGHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handlingEPSS 1.1%