Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2021-33605MEDIUMUnauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20EPSS 0.7%CVE-2021-31364MEDIUMJunos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is receivedEPSS 0.7%CVE-2023-49607MEDIUMPlaybook plugin crash via missing interface type assertionEPSS 0.6%CVE-2023-34099MEDIUMImproper mail validation in ShopwareEPSS 0.6%CVE-2019-1849HIGHCisco IOS XR Software BGP MPLS-Based EVPN Denial of Service VulnerabilityEPSS 0.6%CVE-2024-47499HIGHJunos OS and Junos OS Evolved: In a BMP scenario receipt of a malformed AS PATH attribute can cause an RPD crashEPSS 0.6%CVE-2023-36835HIGHJunos OS: QFX10000 Series: All traffic will be dropped after a specific valid IP packet has been received which needs to be routed over a VXLAN tunnelEPSS 0.6%CVE-2025-12387MEDIUMDenial of Service in Pix-Link LV-WR21QEPSS 0.6%CVE-2022-22235MEDIUMJunos OS: SRX Series: A flowd core will be observed when malformed GPRS traffic is processedEPSS 0.6%CVE-2023-32716MEDIUMDenial of Service via the 'dump' SPL commandEPSS 0.6%CVE-2024-37151MEDIUMSuricata defrag: IP ID reuse can lead to policy bypassEPSS 0.6%CVE-2023-25619HIGH A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller wEPSS 0.6%CVE-2024-8175HIGHCODESYS: web server vulnerable to DoSEPSS 0.6%CVE-2023-28976HIGHJunos OS: MX Series: If a specific traffic rate goes above the DDoS threshold it will lead to an FPC crashEPSS 0.6%CVE-2026-0287MEDIUMPAN-OS: Denial of Service Vulnerabilities in Network Traffic ProcessingEPSS 0.6%CVE-2024-36128HIGHDirectus is soft-locked by providing a string value to random string utilEPSS 0.6%CVE-2023-22393HIGHJunos OS and Junos OS Evolved: RPD crash upon receipt of BGP route with invalid next-hop EPSS 0.6%CVE-2026-33939HIGHHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationEPSS 0.6%CVE-2023-48431MEDIUMA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correctly validate the respoEPSS 0.6%CVE-2026-73549MEDIUMEnvoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clustersEPSS 0.6%