Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2026-57031MEDIUMJunos OS: MX Series: For subscribers configured on static interfaces, input filters are not in effectEPSS 0.2%CVE-2023-38420LOWImproper conditions check in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable infEPSS 0.2%CVE-2026-66774LOWMultiple vulnerabilities in SAP Business AI Platform (Approuter)EPSS 0.2%CVE-2025-22848MEDIUMImproper conditions check for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentialEPSS 0.2%CVE-2022-28793MEDIUMGiven the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT EPSS 0.2%CVE-2021-29533LOWCHECK-fail in DrawBoundingBoxesEPSS 0.2%CVE-2024-56692HIGHf2fs: fix to do sanity check on node blkaddr in truncate_node()EPSS 0.2%CVE-2026-8491LOWNode View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034EPSS 0.2%CVE-2025-20625HIGHImproper conditions check for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.110.0.5 may allow an unauthenticatedEPSS 0.2%CVE-2024-9469MEDIUMCortex XDR Agent: Local Windows User Can Disable the AgentEPSS 0.2%CVE-2024-56728MEDIUMocteontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.cEPSS 0.2%CVE-2026-13417MEDIUMBoards plugin denial of service via unvalidated block fields.propertiesEPSS 0.2%CVE-2026-87532MEDIUMImproper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictEPSS 0.2%CVE-2026-30960CRITICALRSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI InterfaceEPSS 0.2%CVE-2026-0944MEDIUMGroup invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001EPSS 0.2%CVE-2024-56777MEDIUMdrm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_checkEPSS 0.2%CVE-2024-56776MEDIUMdrm/sti: avoid potential dereference of error pointersEPSS 0.2%CVE-2024-50196MEDIUMpinctrl: ocelot: fix system hang on level based interruptsEPSS 0.2%CVE-2026-42950MEDIUMELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page whileEPSS 0.2%CVE-2024-56778MEDIUMdrm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_checkEPSS 0.2%