Fallos del tipo CWE-476

2331 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2023-0394MEDIUMA NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. ThEPSS 1.0%CVE-2020-12514MEDIUMPepper+Fuchs Comtrol IO-Link Master NULL Pointer DereferenceEPSS 1.0%CVE-2026-25075HIGHstrongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer UnderflowEPSS 1.0%CVE-2019-14871MEDIUMThe REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macEPSS 1.0%CVE-2023-0845MEDIUMConsul Server Panic when Ingress and API Gateways Configured with PeeringEPSS 1.0%CVE-2024-38573HIGHcppc_cpufreq: Fix possible null pointer dereferenceEPSS 1.0%CVE-2023-1994MEDIUMGQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture fileEPSS 1.0%CVE-2022-23570MEDIUMNull-dereference in TensorflowEPSS 1.0%CVE-2022-29224MEDIUMSegmentation fault leading to crash in EnvoyEPSS 1.0%CVE-2024-36424MEDIUMK7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer derefEPSS 1.0%CVE-2021-37615MEDIUMNull pointer dereference in Exiv2::Internal::resolveLens0x319EPSS 1.0%CVE-2023-49083MEDIUMcryptography vulnerable to NULL-dereference when loading PKCS7 certificatesEPSS 1.0%CVE-2026-14457HIGHRPK Server Signature Algorithm Selection Can Dereference a Missing CertificateEPSS 1.0%CVE-2025-1735MEDIUMpgsql extension does not check for errors during escapingEPSS 1.0%CVE-2022-1748HIGHSofting Secure Integration Server NULL Pointer DereferenceEPSS 1.0%CVE-2022-23020—On BIG-IP version 16.1.x before 16.1.2, when the 'Respond on Error' setting is enabled on the Request Logging profile and configured on a viEPSS 1.0%CVE-2024-35857HIGHicmp: prevent possible NULL dereferences from icmp_build_probe()EPSS 1.0%CVE-2025-6491MEDIUMNULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace PrefixEPSS 1.0%CVE-2021-28166MEDIUMIn Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to thEPSS 1.0%CVE-2022-47929MEDIUMIn the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a dEPSS 1.0%