Fallos del tipo CWE-476

2571 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2026-3238HIGHSamba: denial of service against ad dc wins serverEPSS 2.7%CVE-2021-22570MEDIUMNullptr Dereference in ProtobufEPSS 2.7%CVE-2024-38126HIGHWindows Network Address Translation (NAT) Denial of Service VulnerabilityEPSS 2.7%CVE-2016-6561—illumos smbsrv NULL pointer dereference allows system crash.EPSS 2.5%CVE-2018-10918MEDIUMA null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker cEPSS 2.5%CVE-2023-36602HIGHWindows TCP/IP Denial of Service VulnerabilityEPSS 2.5%CVE-2023-36603HIGHWindows TCP/IP Denial of Service VulnerabilityEPSS 2.5%CVE-2024-38146HIGHWindows Layer-2 Bridge Network Driver Denial of Service VulnerabilityEPSS 2.5%CVE-2024-38145HIGHWindows Layer-2 Bridge Network Driver Denial of Service VulnerabilityEPSS 2.5%CVE-2023-29179MEDIUMA null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, Fortiproxy version 7EPSS 2.5%CVE-2022-2309MEDIUMNULL Pointer Dereference in lxml/lxmlEPSS 2.4%CVE-2024-38233HIGHWindows Networking Denial of Service VulnerabilityEPSS 2.4%CVE-2021-40732MEDIUMXMP Toolkit SDK Null Pointer DereferenceEPSS 2.4%CVE-2010-4816—It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of serviEPSS 2.4%CVE-2021-39860MEDIUMAdobe Acrobat Reader DC Search Plugin Null Pointer DereferenceEPSS 2.4%CVE-2021-39854MEDIUMAdobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-ServiceEPSS 2.4%CVE-2020-10739HIGHIstio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specialEPSS 2.4%CVE-2020-10703MEDIUMA NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fEPSS 2.4%CVE-2024-49121HIGHWindows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityEPSS 2.4%CVE-2024-38232HIGHWindows Networking Denial of Service VulnerabilityEPSS 2.3%