Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2025-9998MEDIUMImproper validation of packets sequencingEPSS 0.3%CVE-2025-15542MEDIUMDenial of Service (DoS) of VoIP Communication on TP-Link VX800vEPSS 0.3%CVE-2025-20761MEDIUMIn Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connectEPSS 0.3%CVE-2025-59960MEDIUMJunos OS and Junos OS Evolved: DHCP Option 82 messages from clients being passed unmodified to the DHCP serverEPSS 0.3%CVE-2026-6766HIGHIncorrect boundary conditions in the Libraries component in NSSEPSS 0.3%CVE-2026-5343HIGHSAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031EPSS 0.3%CVE-2025-11925CRITICALIncorrect Content-Type HeaderEPSS 0.3%CVE-2026-93387MEDIUMImproper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafteEPSS 0.3%CVE-2025-0503LOWLeaked User IDs and Metadata of Deleted DMsEPSS 0.3%CVE-2026-94105MEDIUMNivoCart through 2.4.0 Destructive Configuration Write via the Password Reset ControllerEPSS 0.3%CVE-2026-4748HIGHpf silently ignores certain rulesEPSS 0.3%CVE-2026-10556MEDIUMUnauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.EPSS 0.2%CVE-2026-44621MEDIUMLibunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminatedEPSS 0.2%CVE-2024-25739MEDIUMcreate_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a miEPSS 0.2%CVE-2024-0675MEDIUMImproper checking for unusual or exceptional conditions vulnerability in Lamassu Bitcoin ATM Douro machinesEPSS 0.2%CVE-2025-21597MEDIUMJunos OS and Junos OS Evolved: When BGP rib-sharding and update-threading are configured and a peer flaps, an rpd core is observedEPSS 0.2%CVE-2024-39517HIGHJunos OS and Junos OS Evolved: Upon processing specific L2 traffic, rpd can hang in devices with EVPN/VXLAN configuredEPSS 0.2%CVE-2021-22744—Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems thatEPSS 0.2%CVE-2021-22742—Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems thatEPSS 0.2%CVE-2026-42349HIGHClerk: Authorization bypass when combining organization, billing, or reverification checksEPSS 0.2%