Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2026-49325MEDIUMIndian Scout Bobber 2025 WCM voltage-based shutdownEPSS 0.2%CVE-2025-20198MEDIUMA vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privilegEPSS 0.2%CVE-2025-10937MEDIUMOxford Nanopore Technologies MinKNOW Improper Check for Unusual or Exceptional ConditionsEPSS 0.2%CVE-2024-35427MEDIUMvmir e8117 was discovered to contain a segmentation violation via the export_function function at /src/vmir_wasm_parser.c.EPSS 0.2%CVE-2025-33030LOWImproper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 3: User Applications may allow an escalation of privileEPSS 0.1%CVE-2026-22795MEDIUMMissing ASN1_TYPE validation in PKCS#12 parsingEPSS 0.1%CVE-2025-30655MEDIUMJunos OS and Junos OS Evolved: A specific CLI command will cause an RPD crash when rib-sharding and update-threading is enabledEPSS 0.1%CVE-2024-12533LOWImproper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore Technology 4 allows Input Data Manipulation.This isEPSS 0.1%CVE-2024-29980MEDIUMUnsafe Handling of IHV UEFI VariablesEPSS 0.1%CVE-2024-27457LOWImproper check for unusual or exceptional conditions in Intel(R) TDX Module firmware before version 1.5.06 may allow a privileged user to poEPSS 0.1%CVE-2026-0230MEDIUMCortex XDR Agent: Local Administrator can disable the agent on macOSEPSS 0.1%CVE-2026-49318LOWIndian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at bootEPSS 0.1%CVE-2026-49317LOWIndian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at bootEPSS 0.1%CVE-2025-20093HIGHImproper check for unusual or exceptional conditions in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.EPSS 0.1%CVE-2025-43883MEDIUMDell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper check for unusual or exceptional conditions vulnerability. A high prEPSS 0.1%CVE-2024-54175MEDIUMIBM MQ denial of serviceEPSS 0.1%CVE-2024-28036MEDIUMImproper conditions check for some Intel(R) Arc™ GPU may allow an authenticated user to potentially enable denial of service via local accesEPSS 0.1%CVE-2026-20769MEDIUMImproper conditions check for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. UnpriEPSS 0.1%CVE-2026-21764LOWInsufficient Input Validation in DevOps LoopEPSS 0.1%CVE-2025-24303HIGHImproper check for unusual or exceptional conditions in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.EPSS 0.1%