Fallos del tipo CWE-476

2328 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2018-1172—This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-2018031EPSS 11.0%CVE-2018-1000168HIGHnghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that caEPSS 10.6%CVE-2020-25858—The QCMAP_Web_CLIENT binary in the Qualcomm QCMAP software suite prior to versions released in October 2020 does not validate the return valEPSS 9.6%CVE-2004-0079HIGHThe do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (EPSS 9.5%CVE-2023-3338MEDIUMCrash due to a null pointer dereference in the dn_nsp_send functionEPSS 8.0%CVE-2025-63655HIGHA NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a DeEPSS 7.8%CVE-2022-32230HIGHSMBv3 FileNormalizedNameInformation NULL Pointer DereferenceEPSS 7.5%CVE-2020-1971MEDIUMEDIPARTYNAME NULL pointer dereferenceEPSS 7.1%CVE-2018-1050—All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run aEPSS 6.5%CVE-2023-46728HIGHSQUID-2021:8 Denial of Service in Gopher gatewayEPSS 6.0%CVE-2026-32854MEDIUMLibVNCServer httpd proxy NULL Pointer DereferenceEPSS 5.3%CVE-2017-2634HIGHIt was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used the IPv4-only inet_sk_EPSS 5.2%CVE-2023-24940HIGHWindows Pragmatic General Multicast (PGM) Denial of Service VulnerabilityEPSS 5.2%CVE-2026-21525MEDIUMWindows Remote Access Connection Manager Denial of Service VulnerabilityEPSS 5.0%KEVCVE-2013-6954MEDIUMThe png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL pointer dereference andEPSS 4.7%CVE-2025-11187MEDIUMImproper validation of PBMAC1 parameters in PKCS#12 MAC verificationEPSS 4.7%CVE-2025-60332HIGHA NULL pointer dereference in the SetWLanRadioSettings function of D-Link DIR-823G A1 v1.0.2B05 allows attackers to cause a Denial of ServicEPSS 4.6%CVE-2021-4043MEDIUMNULL Pointer Dereference in gpac/gpacEPSS 4.6%CVE-2022-35691MEDIUMAdobe Acrobat Reader NULL Pointer Dereference Application denial-of-serviceEPSS 4.4%CVE-2020-9746HIGHExploitable NULL pointer deref could lead to arbitrary code executionEPSS 4.3%