Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2024-34694HIGHLNbits improperly handles potential network and payment failures when using Eclair backendEPSS 0.6%CVE-2023-23602MEDIUMContent Security Policy wasn't being correctly applied to WebSockets in WebWorkersEPSS 0.6%CVE-2026-54775MEDIUMCoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.EPSS 0.6%CVE-2022-22227MEDIUMJunos OS Evolved: ACX7000 Series: Specific IPv6 transit traffic gets exceptioned to the routing-engine which causes increased CPU utilizationEPSS 0.6%CVE-2023-29198MEDIUMContext isolation bypass via nested unserializable return value in ElectronEPSS 0.6%CVE-2026-23991MEDIUMgo-tuf affected by client DoS via malformed server responseEPSS 0.6%CVE-2020-5215MEDIUMSegmentation faultin TensorFlow when converting a Python string to tf.float16EPSS 0.6%CVE-2023-25620MEDIUM A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controllerEPSS 0.6%CVE-2024-40619HIGHRockwell Automation GuardLogix/ControlLogix 5580 Controller denial-of-service Vulnerability via Malformed Packet HandlingEPSS 0.6%CVE-2026-4707HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.6%CVE-2018-25007LOWUnauthorized client-side property update in UIDL request handler in Vaadin 10 and 11EPSS 0.6%CVE-2024-45085MEDIUMIBM WebSphere Application Server denial of serviceEPSS 0.6%CVE-2025-4619MEDIUMPAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted PacketsEPSS 0.6%CVE-2022-43393HIGHAn improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70EPSS 0.6%CVE-2022-3192MEDIUM Improper Check for Unusual or Exceptional ConditionsEPSS 0.6%CVE-2023-34348HIGHImproper Check or Handling of Exceptional Conditions in Aveva PI Server EPSS 0.6%CVE-2024-4182MEDIUMMattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom statEPSS 0.6%CVE-2025-54427MEDIUMPolkadot Frontier contains missing `check_inherent` for `note_min_gas_price_target` inflates gas priceEPSS 0.5%CVE-2025-32051MEDIUMLibsoup: segmentation fault when parsing malformed data uriEPSS 0.5%CVE-2024-50284HIGHksmbd: Fix the missing xa_store error checkEPSS 0.5%