Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2024-56777MEDIUMdrm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_checkEPSS 0.2%CVE-2024-35424MEDIUMvmir e8117 was discovered to contain a segmentation violation via the import_function function at /src/vmir_wasm_parser.c.EPSS 0.2%CVE-2026-65904LOWDOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE modeEPSS 0.2%CVE-2024-35421MEDIUMvmir e8117 was discovered to contain a segmentation violation via the wasm_parse_block function at /src/vmir_wasm_parser.c.EPSS 0.2%CVE-2025-3359MEDIUMGnuplot: segmentation fault via io_str_init_static_internal functionEPSS 0.2%CVE-2025-0112MEDIUMCortex XDR Agent: Local Windows User Can Disable the AgentEPSS 0.2%CVE-2025-4675HIGHImproper implementation of Modbus protocol leading to DOS attackEPSS 0.2%CVE-2022-29278HIGHIncorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory Incorrect pointer checks within the NvEPSS 0.2%CVE-2025-43715HIGHNullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation,EPSS 0.2%CVE-2025-71413MEDIUMIn CPDLC, Malformed or Out of Sequence Frames Can Cause ResetsEPSS 0.2%CVE-2022-47112LOW7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffecEPSS 0.2%CVE-2025-30258LOWIn GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incEPSS 0.2%CVE-2021-29531LOWCHECK-fail in tf.raw_ops.EncodePngEPSS 0.2%CVE-2021-29534LOWCHECK-fail in SparseConcatEPSS 0.2%CVE-2025-64704MEDIUMWebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instructionEPSS 0.2%CVE-2025-48581HIGHIn VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the code. This could leEPSS 0.2%CVE-2024-29979MEDIUMUnsafe Handling of Phoenix UEFI VariablesEPSS 0.2%CVE-2026-20747HIGHImproper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. NetwoEPSS 0.2%CVE-2025-71412HIGHIn CPDLC, False Emergency or Status Messages Will be Accepted as LegitimateEPSS 0.2%CVE-2022-26079MEDIUMImproper conditions check in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to poEPSS 0.2%