Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2024-47503HIGHJunos OS: SRX4600 and SRX5000 Series: Sequence of specific PIM packets causes a flowd crashEPSS 0.3%CVE-2025-58354MEDIUMKata Containers coco-tdx malicious host can circumvent initdata verificationEPSS 0.3%CVE-2026-73430MEDIUMRussh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)EPSS 0.3%CVE-2026-33790HIGHJunos OS: SRX Series: In a NAT64 configuration, receipt of a specific, malformed ICMPv6 packet will cause the srxpfe process to crash and restart.EPSS 0.3%CVE-2024-39535HIGHJunos OS Evolved: ACX 7000 Series: When specific traffic is received in a VPLS scenario evo-pfemand crashesEPSS 0.3%CVE-2023-52534MEDIUMIn ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote denial of service with no additioEPSS 0.3%CVE-2025-13080MEDIUMDrupal core - Moderately critical - Denial of Service - SA-CORE-2025-005EPSS 0.3%CVE-2025-22445LOWMisleading UI for undefined admin console settings in Calls causes security confusionEPSS 0.3%CVE-2026-40249MEDIUMfree5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errorsEPSS 0.3%CVE-2026-24513LOWingress-nginx auth-url protection bypassEPSS 0.3%CVE-2026-21689MEDIUMiccDEV has Type Confusion in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cppEPSS 0.3%CVE-2024-20506MEDIUMClamAV Privilege Handling Escalation VulnerabilityEPSS 0.3%CVE-2026-75595CRITICALNetty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContextEPSS 0.3%CVE-2025-53638MEDIUMSolady lacks extcodesize validation on implementation in ERC4337FactoryEPSS 0.3%CVE-2025-0128HIGHPAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted PacketEPSS 0.3%CVE-2025-55035MEDIUMMattermost Desktop DoS when user has basic authentication server configuredEPSS 0.3%CVE-2026-91733HIGHImproper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer processEPSS 0.3%CVE-2024-39561MEDIUMJunos OS: SRX4600, SRX5000 Series: TCP packets with SYN/FIN or SYN/RST are transferred after enabling no-syn-check with Express PathEPSS 0.3%CVE-2026-42246HIGHnet-imap vulnerable to STARTTLS stripping via invalid response timingEPSS 0.3%CVE-2025-10532MEDIUMIncorrect boundary conditions in the JavaScript: GC componentEPSS 0.3%