Fallos del tipo CWE-754

507 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2026-4714HIGHIncorrect boundary conditions in the Audio/Video componentEPSS 0.4%CVE-2026-63754HIGHSurrealDB before 3.1.0 Denial of Service via LIVE QueryEPSS 0.4%CVE-2026-4713HIGHIncorrect boundary conditions in the Graphics componentEPSS 0.4%CVE-2026-22992HIGHlibceph: return the handler error from mon_handle_auth_done()EPSS 0.4%CVE-2025-1718HIGHAn authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to imEPSS 0.4%CVE-2025-0130HIGHPAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted PacketsEPSS 0.4%CVE-2025-61668HIGH@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous userEPSS 0.4%CVE-2024-38461HIGHirodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory.EPSS 0.4%CVE-2025-21594HIGHJunos OS: MX Series: In DS-lite and NAT scenario receipt of crafted IPv6 traffic causes port blockEPSS 0.4%CVE-2025-30660HIGHJunos OS: MX Series: Decapsulation of specific GRE packets leads to PFE resetEPSS 0.4%CVE-2026-94105MEDIUMNivoCart through 2.4.0 Destructive Configuration Write via the Password Reset ControllerEPSS 0.4%CVE-2025-64342MEDIUMESF-IDF's ESP32 Bluetooth Controller Has an Invalid Access Address VulnerabilityEPSS 0.4%CVE-2024-5469LOWUncontrolled Resource Consumption in GitLabEPSS 0.4%CVE-2026-43928LOWFOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpaymentEPSS 0.4%CVE-2025-60004HIGHJunos OS and Junos OS Evolved: Specific BGP EVPN update message causes rpd crashEPSS 0.4%CVE-2026-44324MEDIUMfree5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)EPSS 0.4%CVE-2026-10556MEDIUMUnauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.EPSS 0.4%CVE-2026-8075MEDIUMPosting a malicious markdown image crashes the Mattermost Desktop AppEPSS 0.4%CVE-2023-44198MEDIUMJunos OS: SRX Series and MX Series: SIP ALG doesn't drop specifically malformed retransmitted SIP packetsEPSS 0.4%CVE-2025-53359MEDIUMethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactionsEPSS 0.4%