Fallos del tipo CWE-476

2571 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2024-0727MEDIUMPKCS12 Decoding crashesEPSS 3.2%CVE-2024-38477HIGHApache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious requestEPSS 3.2%CVE-2021-21702MEDIUMNull Dereference in SoapClientEPSS 3.2%CVE-2019-9923HIGHpax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extendEPSS 3.2%CVE-2020-25692—A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticEPSS 3.1%CVE-2020-1730MEDIUMA flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The serEPSS 3.1%CVE-2024-26219HIGHHTTP.sys Denial of Service VulnerabilityEPSS 3.1%CVE-2019-5054HIGHAn exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000v5 with Firmware VerEPSS 3.1%CVE-2020-13574HIGHA denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request EPSS 3.1%CVE-2020-13577HIGHA denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request EPSS 3.1%CVE-2020-10711MEDIUMA NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing tEPSS 3.1%CVE-2020-13578HIGHA denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request EPSS 3.1%CVE-2017-11185HIGHThe gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) vEPSS 2.8%CVE-2023-29180HIGHA null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12EPSS 2.8%CVE-2024-20661HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.8%CVE-2026-76166MEDIUMModcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagramEPSS 2.7%CVE-2024-21404HIGH.NET Denial of Service VulnerabilityEPSS 2.7%CVE-2018-16871HIGHA flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mouEPSS 2.7%CVE-2023-36709HIGHMicrosoft AllJoyn API Denial of Service VulnerabilityEPSS 2.7%CVE-2026-3238HIGHSamba: denial of service against ad dc wins serverEPSS 2.7%