Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2024-50145HIGHocteon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()EPSS 0.6%CVE-2026-15891HIGHNULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gatewayEPSS 0.6%CVE-2026-24293HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-57195HIGHAsterisk: NULL Pointer Dereference in HTTP AMI Digest AuthenticationEPSS 0.6%CVE-2024-54952HIGHMikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issEPSS 0.6%CVE-2024-25177HIGHLuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of SeEPSS 0.6%CVE-2026-90782MEDIUMS2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()EPSS 0.6%CVE-2026-27141HIGHSending certain HTTP/2 frames can cause a server to panic in golang.org/x/netEPSS 0.6%CVE-2022-2549MEDIUMNULL Pointer Dereference in gpac/gpacEPSS 0.6%CVE-2025-65411HIGHA NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injectiEPSS 0.6%CVE-2026-29781LOWSliver: Authenticated Nil-Pointer Dereference in HandlersEPSS 0.6%CVE-2024-3858HIGHIt was possible to mutate a JavaScript object so that the JIT could crash while tracing it. This vulnerability affects Firefox < 125.EPSS 0.6%CVE-2025-64527MEDIUMEnvoy crashes when JWT authentication is configured with the remote JWKS fetchingEPSS 0.6%CVE-2026-109967HIGHyt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.FormatsEPSS 0.6%CVE-2023-52883HIGHdrm/amdgpu: Fix possible null pointer dereferenceEPSS 0.6%CVE-2026-11788MEDIUM389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parserEPSS 0.6%CVE-2024-39948HIGHA vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, cEPSS 0.6%CVE-2026-31414CRITICALnetfilter: nf_conntrack_expect: use expect->helperEPSS 0.6%CVE-2026-3408MEDIUMOpen Babel CDXML File atom.cpp GetExplicitValence null pointer dereferenceEPSS 0.6%CVE-2022-4121MEDIUMIn libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to EPSS 0.6%