Fallos del tipo CWE-754

460 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2019-6856HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, ModiconEPSS 1.6%CVE-2019-6857HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, ModiconEPSS 1.6%CVE-2021-43801HIGHUncaught Exception in mercuriusEPSS 1.5%CVE-2021-1446HIGHCisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service VulnerabilityEPSS 1.5%CVE-2022-31103HIGHImproper handling of CSS at-rules in lettersanitizerEPSS 1.5%CVE-2020-24677HIGHInsecure Web Service in Symphony PlusEPSS 1.4%CVE-2026-39929HIGHLakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDPEPSS 1.4%CVE-2020-3480HIGHCisco IOS XE Software Zone-Based Firewall Denial of Service VulnerabilitiesEPSS 1.4%CVE-2019-6831—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmwaEPSS 1.4%CVE-2020-7537—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers ModicEPSS 1.4%CVE-2018-7794HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, ModiconEPSS 1.4%CVE-2020-7543—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers ModicEPSS 1.3%CVE-2020-7542—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers ModicEPSS 1.3%CVE-2020-1999MEDIUMPAN-OS: Threat signatures are evaded by specifically crafted packetsEPSS 1.3%CVE-2020-7477HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module 140NOE771x1 (VersionEPSS 1.3%CVE-2019-15989HIGHCisco IOS XR Software Border Gateway Protocol Attribute Denial of Service VulnerabilityEPSS 1.3%CVE-2019-6811—An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earliEPSS 1.3%CVE-2019-0068MEDIUMJunos OS: SRX Series: Denial of Service vulnerability in flowd due to multicast packetsEPSS 1.3%CVE-2023-23931MEDIUMCipher.update_into can corrupt memory in pyca cryptographyEPSS 1.3%CVE-2022-32749HIGHApache Traffic Server: Improperly handled requests can cause crashes in specific pluginsEPSS 1.3%