Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2022-31077MEDIUMMalicious response from KubeEdge can crash CSI Driver controller serverEPSS 0.8%CVE-2023-33306MEDIUMA null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allEPSS 0.8%CVE-2025-24177HIGHA null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macEPSS 0.8%CVE-2026-28389HIGHPossible NULL Dereference When Processing CMS KeyAgreeRecipientInfoEPSS 0.8%CVE-2026-28390HIGHPossible NULL Dereference When Processing CMS KeyTransportRecipientInfoEPSS 0.8%CVE-2018-6343HIGHProxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsiEPSS 0.8%CVE-2024-26130HIGHcryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash overrideEPSS 0.8%CVE-2024-23080CRITICALJoda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NEPSS 0.8%CVE-2024-26731MEDIUMbpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()EPSS 0.8%CVE-2022-40733MEDIUMAn access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of WindEPSS 0.8%CVE-2019-1010162—jsish 2.4.74 2.0474 is affected by: CWE-476: NULL Pointer Dereference. The impact is: denial of service. The component is: function Jsi_StrcEPSS 0.8%CVE-2022-0890MEDIUMNULL Pointer Dereference in mruby/mrubyEPSS 0.8%CVE-2020-27819—An issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files. A NULL pointer dereference vulnerability exEPSS 0.8%CVE-2022-1035LOWSegmentation Fault caused by MP4Box -lsr in gpac/gpacEPSS 0.8%CVE-2023-52696HIGHpowerpc/powernv: Add a null pointer check in opal_powercap_init()EPSS 0.8%CVE-2025-15468MEDIUMNULL dereference in SSL_CIPHER_find() function on unknown cipher IDEPSS 0.8%CVE-2026-77901HIGHMicrosoft Office Word Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-36620MEDIUMmoby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.EPSS 0.8%CVE-2024-43559MEDIUMWindows Mobile Broadband Driver Denial of Service VulnerabilityEPSS 0.8%CVE-2025-53477HIGHApache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layerEPSS 0.8%