Fallos del tipo CWE-476

2331 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2026-23831MEDIUMRekor COSE v0.0.1 Canonicalize crashes when passed empty MessageEPSS 0.4%CVE-2022-41889MEDIUMSegfault via invalid attributes in `pywrap_tfe_src.cc` in TensorflowEPSS 0.4%CVE-2025-59148HIGHSuricata's improper use of entropy keyword can lead to a NULL-ptr derefEPSS 0.4%CVE-2023-30755MEDIUMA vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUEPSS 0.4%CVE-2026-92413MEDIUMArtifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereferenceEPSS 0.4%CVE-2026-77217MEDIUMPLANET GS-4210-16P2S V3 Stack Buffer Overflow and NULL Pointer Dereference via dispatcher.cgi RADIUS HandlersEPSS 0.4%CVE-2023-33056HIGHNULL Pointer dereference in WLAN FirmwareEPSS 0.4%CVE-2022-21546HIGHscsi: target: Fix WRITE_SAME No Data Buffer crashEPSS 0.4%CVE-2026-67184HIGHTinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP RequestEPSS 0.4%CVE-2021-42376—A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validEPSS 0.4%CVE-2023-5441MEDIUMNULL Pointer Dereference in vim/vimEPSS 0.4%CVE-2025-59777HIGHNULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the EPSS 0.4%CVE-2024-45156HIGHAnimate | NULL Pointer Dereference (CWE-476)EPSS 0.4%CVE-2025-43967LOWlibheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can referencEPSS 0.4%CVE-2022-39837MEDIUMAn issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a craftedEPSS 0.4%CVE-2025-69624HIGHNitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert(). WhEPSS 0.4%CVE-2025-55780HIGHA null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. SEPSS 0.4%CVE-2023-2731MEDIUMA NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attackerEPSS 0.4%CVE-2025-65564HIGHA denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives aEPSS 0.4%CVE-2024-9472HIGHPAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted TrafficEPSS 0.4%