Fallos del tipo CWE-476

2332 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2022-49707MEDIUMext4: add reserved GDT blocks checkEPSS 0.3%CVE-2023-52585MEDIUMdrm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()EPSS 0.3%CVE-2024-53952MEDIUMInDesign Desktop | NULL Pointer Dereference (CWE-476)EPSS 0.3%CVE-2024-26903MEDIUMBluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_securityEPSS 0.3%CVE-2021-47657MEDIUMdrm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()EPSS 0.3%CVE-2022-49335MEDIUMdrm/amdgpu/cs: make commands with 0 chunks illegal behaviour.EPSS 0.3%CVE-2023-45913MEDIUMMesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId(). This vulnerability iEPSS 0.3%CVE-2025-65835MEDIUMThe Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an exported broadcast receiveEPSS 0.3%CVE-2024-26475MEDIUMAn issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of service via the grubEPSS 0.3%CVE-2022-49323MEDIUMiommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe()EPSS 0.3%CVE-2022-41841MEDIUMAn issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_File::ParseStream in Core/Ap4File.cpp, which iEPSS 0.3%CVE-2023-52490MEDIUMmm: migrate: fix getting incorrect page mapping during page migrationEPSS 0.3%CVE-2024-30403HIGHJunos OS Evolved: When MAC learning happens, and an interface gets flapped, the PFE crashesEPSS 0.3%CVE-2022-49491MEDIUMdrm/rockchip: vop: fix possible null-ptr-deref in vop_bind()EPSS 0.3%CVE-2022-49495MEDIUMdrm/msm/hdmi: check return value after calling platform_get_resource_byname()EPSS 0.3%CVE-2023-29569MEDIUMCesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c. This vulnerability can lead to EPSS 0.3%CVE-2023-5972HIGHKernel: the nfta_inner_num and nfta_expr_name netlink attributes accessed without checking its presence in nft_inner.cEPSS 0.3%CVE-2022-4981MEDIUMDCMTK dcmqrscp dcmqrcnf.cc readPeerList null pointer dereferenceEPSS 0.3%CVE-2025-68141HIGHEVerest vulnerable to null pointer dereference during DC_ChargeLoopRes document deserializationEPSS 0.3%CVE-2020-35503—A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. EPSS 0.3%