Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2024-2551HIGHPAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted PacketEPSS 0.5%CVE-2024-45239HIGHAn issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync oEPSS 0.5%CVE-2026-82953MEDIUMApache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of ServiceEPSS 0.5%CVE-2021-20196—A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commandsEPSS 0.5%CVE-2018-1130MEDIUMLinux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that EPSS 0.5%CVE-2025-52984HIGHJunos OS and Junos OS Evolved: When a static route points to a reject next-hop and a gNMI query for this route is processed, RPD crashesEPSS 0.5%CVE-2022-36011MEDIUMNull dereference on MLIR on empty function attributes in TensorFlowEPSS 0.5%CVE-2022-36000MEDIUMNull dereference on MLIR on empty function attributes in TensorFlowEPSS 0.5%CVE-2026-119760HIGHsniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()EPSS 0.5%CVE-2025-59668HIGHMultiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability. When processing a crafted certain UDP packetEPSS 0.5%CVE-2026-24404HIGHiccDEV has Null Pointer Deference and Undefined Behavior in CIccXmlArrayType()EPSS 0.5%CVE-2023-3772MEDIUMKernel: xfrm: null pointer dereference in xfrm_update_ae_params()EPSS 0.5%CVE-2017-12153—A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This fEPSS 0.5%CVE-2026-10852MEDIUMWebsphere Application Server is Affected By a Denial of ServiceEPSS 0.5%CVE-2026-78126MEDIUMstrongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.EPSS 0.5%CVE-2022-48606—Stability-related vulnerability in the binder background management and control module. Successful exploitation of this vulnerability may afEPSS 0.5%CVE-2025-58144HIGHArm issues with page refcountingEPSS 0.5%CVE-2026-100349HIGHkin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with contentEPSS 0.5%CVE-2026-81490HIGHMongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL ServiceEPSS 0.5%CVE-2023-2609HIGHNULL Pointer Dereference in vim/vimEPSS 0.5%