Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2024-34360HIGHPrevious ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATXEPSS 0.7%CVE-2026-20419MEDIUMIn wlan AP/STA firmware, there is a possible system becoming irresponsive due to an uncaught exception. This could lead to remote (proximal/EPSS 0.7%CVE-2023-45812HIGHImproper Check or Handling of Exceptional Conditions in apollo-routerEPSS 0.7%CVE-2024-53916HIGHIn OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the pEPSS 0.7%CVE-2024-53432HIGHWhile parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::out_of_range exception in PCLPointCloud2::at. EPSS 0.7%CVE-2021-0225MEDIUMJunos OS Evolved: Stateless IP firewall filter does not work as expectedEPSS 0.7%CVE-2026-4686HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.7%CVE-2024-32867MEDIUMSuricata's defrag contains various issues leading to policy bypassEPSS 0.7%CVE-2024-21614HIGHJunos OS and Junos OS Evolved: A specific query via DREND causes rpd crashEPSS 0.7%CVE-2024-38355HIGHUnhandled 'error' event in socket.ioEPSS 0.7%CVE-2026-4699HIGHIncorrect boundary conditions in the Layout: Text and Fonts componentEPSS 0.7%CVE-2026-4695HIGHIncorrect boundary conditions in the Audio/Video: Web Codecs componentEPSS 0.7%CVE-2026-4693HIGHIncorrect boundary conditions in the Audio/Video: Playback componentEPSS 0.7%CVE-2026-4697HIGHIncorrect boundary conditions in the Audio/Video: Web Codecs componentEPSS 0.7%CVE-2026-4685HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.7%CVE-2023-4583HIGHBrowsing Context potentially not cleared when closing Private WindowEPSS 0.7%CVE-2023-52079MEDIUMConversion of property names to strings can trigger infinite recursionEPSS 0.7%CVE-2023-32726LOWPossible buffer overread from reading DNS responsesEPSS 0.7%CVE-2024-51470MEDIUMIBM MQ denial of serviceEPSS 0.7%CVE-2021-37862LOWMattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into EPSS 0.7%