Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2026-79072HIGHImproper state validation in Performance in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory insideEPSS 0.3%CVE-2021-29544LOWCHECK-fail in `QuantizeAndDequantizeV4Grad`EPSS 0.3%CVE-2024-20089HIGHIn wlan, there is a possible denial of service due to incorrect error handling. This could lead to remote denial of service with no additionEPSS 0.3%CVE-2023-28974HIGHJunos OS: MX Series: In a BBE scenario upon receipt of specific malformed packets from subscribers the process bbe-smgd will crashEPSS 0.3%CVE-2026-79073HIGHImproper state validation in Parser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code EPSS 0.3%CVE-2025-4663MEDIUMDenial-of-Service (DoS) after Unusual or Exceptional Conditions vulnerabilityEPSS 0.3%CVE-2026-40094MEDIUMnimiq-blockchain: network-libp2p untrusted peer can crash address book via empty peer contact addressesEPSS 0.3%CVE-2025-24161MEDIUMThe issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS SonoEPSS 0.3%CVE-2023-21405MEDIUMDenial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communicationEPSS 0.3%CVE-2025-54463MEDIUMUnexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence PluginEPSS 0.3%CVE-2024-10635MEDIUMEnterprise Protection S/MIME Opaque Signature Attachment Scanning BypassEPSS 0.3%CVE-2025-66357MEDIUMCHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. When the Video Download featEPSS 0.3%CVE-2026-3109LOWMissing timestamp validation in Zoom webhook handlerEPSS 0.3%CVE-2024-47507MEDIUMJunos OS and Junos OS Evolved: BGP update message containing aggregator attribute with an ASN value of zero (0) is acceptedEPSS 0.3%CVE-2024-42411MEDIUMUser creation date manipulation in POST /api/v4/usersEPSS 0.3%CVE-2022-22238MEDIUMJunos OS and Junos OS Evolved: The rpd process will crash when a malformed incoming RESV message is processedEPSS 0.3%CVE-2025-41241MEDIUMDenial-of-service vulnerabilityEPSS 0.3%CVE-2026-2801HIGHIncorrect boundary conditions in the JavaScript: WebAssembly componentEPSS 0.3%CVE-2026-41662MEDIUMAdmidio: Missing Minimum Administrator Check in Role Membership RemovalEPSS 0.3%CVE-2025-62605MEDIUMMastodon quotes control can be bypassedEPSS 0.3%