Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2026-0401MEDIUMA post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.EPSS 0.4%CVE-2023-37036MEDIUMA Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95EPSS 0.4%CVE-2023-37034MEDIUMA Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95EPSS 0.4%CVE-2025-39851HIGHvxlan: Fix NPD when refreshing an FDB entry with a nexthop objectEPSS 0.4%CVE-2023-37038MEDIUMA Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95EPSS 0.4%CVE-2023-37033MEDIUMA Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95EPSS 0.4%CVE-2025-2956HIGHTRENDnet TI-G102i HTTP Request lighttpd plugins_call_handle_uri_raw null pointer dereferenceEPSS 0.4%CVE-2023-37030MEDIUMA Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95EPSS 0.4%CVE-2025-2957HIGHTRENDnet TEW-411BRP+ HTTP Request httpd sub_401DB0 null pointer dereferenceEPSS 0.4%CVE-2023-37025MEDIUMA Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95EPSS 0.4%CVE-2023-37031MEDIUMA Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95EPSS 0.4%CVE-2023-37037MEDIUMA Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95EPSS 0.4%CVE-2026-111736HIGHNULL pointer dereference on implicit read of user specific record indexEPSS 0.4%CVE-2026-111733HIGHNULL pointer dereference on implicit read of AR specific record indexEPSS 0.4%CVE-2023-37027MEDIUMNull pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5EPSS 0.4%CVE-2025-57155HIGHNULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after EPSS 0.4%CVE-2026-86097HIGHPX4 Autopilot through 1.17.0 Null Pointer Dereference via param selectEPSS 0.4%CVE-2024-43167LOWUnbound: null pointer dereference in unboundEPSS 0.4%CVE-2023-25674HIGHTensorFlow has Null Pointer Error in RandomShuffle with XLA enableEPSS 0.4%CVE-2026-109107MEDIUMWavlink WL-WN592AX6 upload.cgi main null pointer dereferenceEPSS 0.4%