Fallos del tipo CWE-754

507 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2021-37862LOWMattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into EPSS 0.7%CVE-2023-4583HIGHBrowsing Context potentially not cleared when closing Private WindowEPSS 0.7%CVE-2023-52079MEDIUMConversion of property names to strings can trigger infinite recursionEPSS 0.7%CVE-2022-22227MEDIUMJunos OS Evolved: ACX7000 Series: Specific IPv6 transit traffic gets exceptioned to the routing-engine which causes increased CPU utilizationEPSS 0.7%CVE-2025-12387MEDIUMDenial of Service in Pix-Link LV-WR21QEPSS 0.7%CVE-2023-32726LOWPossible buffer overread from reading DNS responsesEPSS 0.7%CVE-2021-33605MEDIUMUnauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20EPSS 0.7%CVE-2025-54427MEDIUMPolkadot Frontier contains missing `check_inherent` for `note_min_gas_price_target` inflates gas priceEPSS 0.7%CVE-2021-31364MEDIUMJunos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is receivedEPSS 0.7%CVE-2026-73314HIGHXenForo < 2.3.13 Signature Verification Bypass via PayPal REST WebhookEPSS 0.7%CVE-2023-34099MEDIUMImproper mail validation in ShopwareEPSS 0.6%CVE-2023-49607MEDIUMPlaybook plugin crash via missing interface type assertionEPSS 0.6%CVE-2019-1849HIGHCisco IOS XR Software BGP MPLS-Based EVPN Denial of Service VulnerabilityEPSS 0.6%CVE-2023-44199HIGHJunos OS: MX Series: In a PTP scenario a prolonged routing protocol churn can trigger an FPC rebootEPSS 0.6%CVE-2023-36835HIGHJunos OS: QFX10000 Series: All traffic will be dropped after a specific valid IP packet has been received which needs to be routed over a VXLAN tunnelEPSS 0.6%CVE-2024-47499HIGHJunos OS and Junos OS Evolved: In a BMP scenario receipt of a malformed AS PATH attribute can cause an RPD crashEPSS 0.6%CVE-2023-22393HIGHJunos OS and Junos OS Evolved: RPD crash upon receipt of BGP route with invalid next-hop EPSS 0.6%CVE-2026-69185HIGHSocket.IO: Zero-attachment Memory ExhaustionEPSS 0.6%CVE-2026-33939HIGHHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationEPSS 0.6%CVE-2023-32716MEDIUMDenial of Service via the 'dump' SPL commandEPSS 0.6%