Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2024-22422HIGHUnauthenticated Denial of Service (DOS) attack in AnythingLLMEPSS 1.0%CVE-2021-22285HIGHSECURITY – Denial of Service Vulnerabilities in SPIET800 INFI-Net to Ethernet Transfer module and PNI800 S+ Ethernet communication interface moduleEPSS 1.0%CVE-2024-50602MEDIUMAn issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspEPSS 1.0%CVE-2026-31790HIGHIncorrect Failure Handling in RSA KEM RSASVE EncapsulationEPSS 1.0%CVE-2021-31351HIGHJunos OS: MX Series: Receipt of specific packet on MS-MPC/MS-MIC causes line card resetEPSS 1.0%CVE-2022-22194HIGHJunos OS Evolved: PTX series: An attacker sending a crafted GRE packet will cause the PFE to restartEPSS 1.0%CVE-2022-23572MEDIUMCrash when type cannot be specialized in TensorflowEPSS 1.0%CVE-2022-24321—A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADEPSS 1.0%CVE-2021-42020HIGHA vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,EPSS 1.0%CVE-2022-23590MEDIUMCrash due to erroneous `StatusOr` in TensorflowEPSS 1.0%CVE-2022-22185HIGHJunos OS: SRX Series: Denial of service vulnerability in flowd daemon upon receipt of a specific fragmented packetEPSS 1.0%CVE-2023-34449MEDIUMink! vulnerable to incorrect decoding of storage value when using `DelegateCall`EPSS 1.0%CVE-2024-23650MEDIUMBuildKit possible panic when incorrect parameters sent from frontendEPSS 1.0%CVE-2023-37303—An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails aftEPSS 1.0%CVE-2021-0282HIGHJunos OS: RPD crash while processing a specific BGP UPDATE when Multipath or add-path features are enabledEPSS 0.9%CVE-2023-48696MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-20837HIGHCisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service VulnerabilityEPSS 0.9%CVE-2025-33201HIGHNVIDIA Triton Inference Server contains a vulnerability where an attacker may cause an improper check for unusual or exceptional conditions EPSS 0.9%CVE-2023-48698MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-22180HIGHJunos OS: EX2300 Series, EX2300-MP Series, EX3400 Series: A slow memory leak due to processing of specific IPv6 packetsEPSS 0.9%