Fallos del tipo CWE-754

507 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2023-25619HIGH A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller wEPSS 0.6%CVE-2024-37151MEDIUMSuricata defrag: IP ID reuse can lead to policy bypassEPSS 0.6%CVE-2024-8175HIGHCODESYS: web server vulnerable to DoSEPSS 0.6%CVE-2026-67416MEDIUMRabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validationEPSS 0.6%CVE-2026-0287MEDIUMPAN-OS: Denial of Service Vulnerabilities in Network Traffic ProcessingEPSS 0.6%CVE-2023-28976HIGHJunos OS: MX Series: If a specific traffic rate goes above the DDoS threshold it will lead to an FPC crashEPSS 0.6%CVE-2024-36128HIGHDirectus is soft-locked by providing a string value to random string utilEPSS 0.6%CVE-2026-73549MEDIUMEnvoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clustersEPSS 0.6%CVE-2023-48431MEDIUMA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correctly validate the respoEPSS 0.6%CVE-2023-46765HIGHVulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability.EPSS 0.6%CVE-2024-34694HIGHLNbits improperly handles potential network and payment failures when using Eclair backendEPSS 0.6%CVE-2023-23602MEDIUMContent Security Policy wasn't being correctly applied to WebSockets in WebWorkersEPSS 0.6%CVE-2026-4707HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.6%CVE-2026-54775MEDIUMCoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.EPSS 0.6%CVE-2026-73430MEDIUMRussh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)EPSS 0.6%CVE-2026-100352HIGHkin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation PathEPSS 0.6%CVE-2026-31637CRITICALrxrpc: reject undecryptable rxkad response ticketsEPSS 0.6%CVE-2023-29198MEDIUMContext isolation bypass via nested unserializable return value in ElectronEPSS 0.6%CVE-2025-24975HIGHFirebird Non-Authorized Access to Encrypted Database Using Execute Statement on ExternalEPSS 0.6%CVE-2026-22796MEDIUMASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() functionEPSS 0.6%