Fallos del tipo CWE-703

154 resultados

Tratamento inadequado de condições excepcionais

É quando o código não verifica ou não lida corretamente com situações de erro, exceção ou estado anômalo. O programa segue adiante como se nada tivesse acontecido, ignorando sinais de falha que deveriam interromper ou redirecionar a execução. Isso pode levar a comportamento imprevisto, vazamento de dados ou falha de segurança.

Ejemplo

Um servidor que recebe uma requisição HTTP não valida; se o parser não verifica o status da leitura e passa dados corrompidos para a próxima camada, a aplicação pode processar lixo como dado legítimo, causando injeção ou bypass de validação.

Cómo mitigar

Sempre verifique o resultado de operações críticas (leitura, alocação, conversão) e implemente blocos catch/finally específicos. Use assertions e logging para detectar estados anômalos cedo, e falhe seguramente (fail-safe) quando algo estiver fora do esperado.

CVE-2024-21894HIGHA heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malEPSS 19.0%CVE-2025-59538HIGHArgo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookEPSS 8.3%CVE-2019-5031HIGHAn exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. A EPSS 6.0%CVE-2023-49786HIGHAsterisk susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 5.3%CVE-2024-10781HIGHSpam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin InstallationEPSS 3.8%CVE-2024-22052HIGHA null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenEPSS 3.8%CVE-2024-22053HIGHA heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malEPSS 3.5%CVE-2024-22023MEDIUMAn XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unautEPSS 3.0%CVE-2017-16014—Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crashEPSS 1.7%CVE-2024-29205HIGHAn Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti PEPSS 1.6%CVE-2022-25252HIGHPTC Axeda agent and Axeda Desktop Server Improper Check or Handling Of Exceptional ConditionsEPSS 1.6%CVE-2023-51443HIGHFreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 1.5%CVE-2022-41777HIGHImproper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlEPSS 1.5%CVE-2018-12551—When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the pEPSS 1.5%CVE-2020-2075—Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LEPSS 1.4%CVE-2020-1644HIGHJunos OS and Junos OS Evolved: RPD crash due to specific BGP UPDATE packetsEPSS 1.3%CVE-2019-10927—A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCAEPSS 1.2%CVE-2024-26007MEDIUMAn improper check or handling of exceptional conditions vulnerability [CWE-703] in Fortinet FortiOS version 7.4.1 allows an unauthenticated EPSS 1.2%CVE-2023-0004MEDIUMPAN-OS: Local File Deletion VulnerabilityEPSS 1.1%CVE-2020-1639HIGHJunos OS: A crafted Ethernet OAM packet received by Junos may cause the Ethernet OAM connectivity fault management process (CFM) to core.EPSS 1.1%