Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2020-7538—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now UnEPSS 1.3%CVE-2020-15202CRITICALInteger truncation in Shard API usageEPSS 1.3%CVE-2017-20166CRITICALEcto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.EPSS 1.3%CVE-2021-32780HIGHIncorrect handling of H/2 GOAWAY followed by SETTINGS framesEPSS 1.2%CVE-2022-24880MEDIUMPotential Captcha Validate Bypass in flask-session-captchaEPSS 1.2%CVE-2025-39682CRITICALtls: fix handling of zero-length records on the rx_listEPSS 1.2%CVE-2020-7539—A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers ModiconEPSS 1.2%CVE-2023-37899HIGHfeathersjs socket handler allows abusing implicit toStringEPSS 1.2%CVE-2020-5420HIGHGorouter is vulnerable to DoS attack via invalid HTTP responsesEPSS 1.2%CVE-2025-24224HIGHThe issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.9, macOS Sequoia 15.5, macOS VentEPSS 1.2%CVE-2022-45788HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of seEPSS 1.2%CVE-2020-7536—A CWE-754:Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M340 CPUs (BMXP34* versions prior to V3.30) MEPSS 1.2%CVE-2020-27274—Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to closEPSS 1.1%CVE-2019-6819HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when speEPSS 1.1%CVE-2020-16125HIGHgdm3 would start gnome-initial-setup if it cannot contact accountserviceEPSS 1.1%CVE-2022-37392MEDIUMApache Traffic Server: Improperly reading the client requestsEPSS 1.1%CVE-2020-7549HIGHA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers ModicoEPSS 1.1%CVE-2020-3449MEDIUMCisco IOS XR Software Additional Paths Denial of Service VulnerabilityEPSS 1.1%CVE-2019-6833MEDIUMA CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTEPSS 1.0%CVE-2021-31361MEDIUMJunos OS: QFX Series and PTX Series: FPC resource usage increases when certain packets are processed which are being VXLAN encapsulatedEPSS 1.0%