Fallos del tipo CWE-617

461 resultados

Asserção acessível por entrada não confiável

Código de produção contém asserções (assert statements) que podem ser disparadas por dados fornecidos pelo usuário ou atacante, causando falha abrupta da aplicação. Diferente de validação, asserções são mecanismos de debug que não deveriam controlar o fluxo normal — quando acionadas, encerram o programa, provocando negação de serviço.

Ejemplo

Um servidor web recebe um parâmetro `user_id` e executa `assert user_id > 0` antes de consultar o banco. Um atacante envia `user_id=0` ou negativo, a asserção falha e derruba o servidor. O código assume que validação já ocorreu, mas ela não existe.

Cómo mitigar

Substitua asserções por validação explícita com tratamento de erro apropriado (throw exception, retornar código de erro). Remova ou desative asserções em builds de produção. Use asserções apenas para condições internas que nunca deveriam ocorrer, nunca para entrada de usuário.

CVE-2021-41200MEDIUMIncomplete validation in `tf.summary.create_file_writer`EPSS 0.2%CVE-2024-7138MEDIUMDenial of Service in Silicon Labs RS9116 Bluetooth SDKEPSS 0.2%CVE-2026-8843HIGHCalling createIndex with certain index types can crash mongodEPSS 0.2%CVE-2025-12131MEDIUMTruncated 802.15.4 packet leads to denial of serviceEPSS 0.2%CVE-2026-46542MEDIUMnimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve pointsEPSS 0.2%CVE-2026-13058HIGHTransaction Command Insufficient Input Validation Leading to Process TerminationEPSS 0.2%CVE-2025-6273MEDIUMWebAssembly wabt binary-reader-objdump.cc LogOpcode assertionEPSS 0.2%CVE-2025-48019MEDIUMA vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciouEPSS 0.2%CVE-2024-34036MEDIUMAn issue was discovered in O-RAN Near Realtime RIC I-Release. To exploit this vulnerability, an attacker can disrupt the initial connection EPSS 0.2%CVE-2023-29935MEDIUMllvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.EPSS 0.2%CVE-2026-13073MEDIUMMongoDB Aggregation Command Invariant Assertion Failure Leading to Process TerminationEPSS 0.2%CVE-2025-9403MEDIUMjqlang jq JSON jq_test.c run_jq_tests assertionEPSS 0.2%CVE-2024-20147MEDIUMIn Bluetooth FW, there is a possible reachable assertion due to improper exception handling. This could lead to remote denial of service witEPSS 0.2%CVE-2025-6952MEDIUMOpen5GS AMF Service amf-sm.c amf_state_operational assertionEPSS 0.2%CVE-2025-69653MEDIUMA crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70EPSS 0.2%CVE-2026-73438HIGHSecurity Advisory 0172EPSS 0.2%CVE-2026-20405MEDIUMIn Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedEPSS 0.2%CVE-2026-20422MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecEPSS 0.2%CVE-2025-50422LOWCairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_finiEPSS 0.2%CVE-2025-7485MEDIUMOpen5GS SCTP Partial Message recv_handler assertionEPSS 0.2%