Fallos del tipo CWE-703

174 resultados

Tratamento inadequado de condições excepcionais

É quando o código não verifica ou não lida corretamente com situações de erro, exceção ou estado anômalo. O programa segue adiante como se nada tivesse acontecido, ignorando sinais de falha que deveriam interromper ou redirecionar a execução. Isso pode levar a comportamento imprevisto, vazamento de dados ou falha de segurança.

Ejemplo

Um servidor que recebe uma requisição HTTP não valida; se o parser não verifica o status da leitura e passa dados corrompidos para a próxima camada, a aplicação pode processar lixo como dado legítimo, causando injeção ou bypass de validação.

Cómo mitigar

Sempre verifique o resultado de operações críticas (leitura, alocação, conversão) e implemente blocos catch/finally específicos. Use assertions e logging para detectar estados anômalos cedo, e falhe seguramente (fail-safe) quando algo estiver fora do esperado.

CVE-2022-23002MEDIUMPoint Compression/Decompression of NIST P-256 points with X coordinate of zeroEPSS 0.7%CVE-2022-23004MEDIUMAlgorithm incorrectly returning error and Invalid unreduced value written to output bufferEPSS 0.7%CVE-2026-21720HIGHUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outEPSS 0.7%CVE-2025-70758HIGHchetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/auth_validate.php. The apEPSS 0.6%CVE-2023-22413HIGHJunos OS: MX Series: The Multiservices PIC Management Daemon (mspmand) will crash when an IPsec6 tunnel processes specific IPv4 packetsEPSS 0.6%CVE-2021-23261MEDIUMOverriding the system configuration file causes a denial of serviceEPSS 0.6%CVE-2026-32641HIGHParseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middlewareEPSS 0.6%CVE-2023-36831HIGHJunos OS: SRX Series: jbuf memory leak when SSL Proxy and UTM Web-Filtering is appliedEPSS 0.6%CVE-2023-28965MEDIUMJunos OS: QFX10002: Failure of storm control feature may lead to Denial of ServiceEPSS 0.6%CVE-2026-44893HIGHNetty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthEPSS 0.6%CVE-2021-3329CRITICALDOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layerEPSS 0.6%CVE-2021-25380MEDIUMImproper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the useEPSS 0.6%CVE-2024-31883MEDIUMIBM Security Verify Access denial of serviceEPSS 0.6%CVE-2025-59531HIGHUnauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payloadEPSS 0.6%CVE-2024-27832CRITICALThe issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, wEPSS 0.6%CVE-2025-59836MEDIUMOmni is Vulnerable to DoS via Empty Create/Update Resource RequestsEPSS 0.6%CVE-2022-34472MEDIUMIf there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrecEPSS 0.6%CVE-2025-24188MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 18.6, macOS Sequoia 15.6. Processing maliciously crafted webEPSS 0.6%CVE-2024-21629MEDIUMErroneous handling of `record_external_operation` error returnEPSS 0.6%CVE-2026-51600HIGHTenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY mEPSS 0.6%