Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2023-52710HIGHHuawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26), As the communication buffer size hasn’t been properly validated to be of the expected siEPSS 0.1%CVE-2026-30900HIGHZoom Workplace Clients for Windows - Improper CheckEPSS 0.1%CVE-2022-20588MEDIUMIn sysmmu_map of sysmmu.c, there is a possible EoP due to a precondition check failure. This could lead to local escalation of privilege witEPSS 0.1%CVE-2026-22760LOWDell Device Management Agent (DDMA), versions prior to 26.02, contain an Improper Check for Unusual or Exceptional Conditions vulnerability.EPSS 0.1%CVE-2026-11970MEDIUMThis vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E EPSS 0.1%CVE-2026-59112MEDIUMSignature validation vulnerability affecting DigiDoc applicationsEPSS 0.1%CVE-2025-32088MEDIUMImproper conditions check for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow a denial oEPSS 0.1%CVE-2026-20486MEDIUMIn imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a mEPSS 0.1%CVE-2026-18852MEDIUMepsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual conditionEPSS 0.1%CVE-2026-0235MEDIUMPrisma Browser: Access and Data Rule BypassEPSS 0.1%CVE-2026-20783MEDIUMImproper conditions check in the firmware for the Intel(R) NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of sEPSS 0.1%CVE-2026-20754MEDIUMImproper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service. UnprivEPSS 0.1%CVE-2025-32735MEDIUMImproper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service. UnprivEPSS 0.1%CVE-2025-20070MEDIUMImproper conditions check for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_02.00.00.4052, CR_MGMT_03.00.00.0538 EPSS 0.1%CVE-2021-25481MEDIUMAn improper error handling in Exynos CP booting driver prior to SMR Oct-2021 Release 1 allows local attackers to bypass a Secure Memory ProtEPSS 0.1%CVE-2026-33786MEDIUMJunos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashesEPSS 0.1%CVE-2022-20426MEDIUMIn multiple functions of many files, there is a possible obstruction of the user's ability to select a phone account due to resource exhaustEPSS 0.1%CVE-2026-33787MEDIUMJunos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specific show command is executed chassisd crashesEPSS 0.1%CVE-2024-20037MEDIUMIn pq, there is a possible write-what-where condition due to an incorrect bounds check. This could lead to local escalation of privilege witEPSS 0.1%CVE-2025-35992MEDIUMImproper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service. UnprivEPSS 0.1%