Fallos del tipo CWE-754

508 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2021-0287MEDIUMJunos OS and Junos OS Evolved: RPD could crash in SR-ISIS/MPLS environment due to a flap of an ISIS link in the networkEPSS 0.4%CVE-2023-28910HIGHDisabled Abortion FlagEPSS 0.4%CVE-2026-85014MEDIUMundici vulnerable to Denial of Service via WebSocketStream unclean closeEPSS 0.4%CVE-2026-21693HIGHiccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cppEPSS 0.4%CVE-2025-52931HIGHUnexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence PluginEPSS 0.4%CVE-2026-13417MEDIUMBoards plugin denial of service via unvalidated block fields.propertiesEPSS 0.4%CVE-2024-7826—Unhandled exception vulnerability that can cause the WRSA.exe service to crash and generate a crash dumpEPSS 0.4%CVE-2026-116516MEDIUMInsufficient length validation when parsing Zoom chat transcriptionsEPSS 0.4%CVE-2025-53638MEDIUMSolady lacks extcodesize validation on implementation in ERC4337FactoryEPSS 0.4%CVE-2026-0262MEDIUMPAN-OS: Denial of Service Vulnerabilities in Network Traffic ParsingEPSS 0.4%CVE-2026-20719MEDIUMDoS via URL Previews Rendering Malicious SVGsEPSS 0.4%CVE-2023-4828MEDIUMITM Server Communications HijackEPSS 0.4%CVE-2026-113260HIGHImproper state validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UEPSS 0.4%CVE-2025-4663MEDIUMDenial-of-Service (DoS) after Unusual or Exceptional Conditions vulnerabilityEPSS 0.4%CVE-2026-66774LOWMultiple vulnerabilities in SAP Business AI Platform (Approuter)EPSS 0.4%CVE-2022-20804MEDIUMCisco Unified Communications Products Denial of Service VulnerabilityEPSS 0.4%CVE-2026-44317MEDIUMfree5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereferenceEPSS 0.4%CVE-2025-13080MEDIUMDrupal core - Moderately critical - Denial of Service - SA-CORE-2025-005EPSS 0.3%CVE-2026-24513LOWingress-nginx auth-url protection bypassEPSS 0.3%CVE-2026-46541HIGHNimiq network-libp2p: DHT query poisoning via first-record verification failureEPSS 0.3%