Fallos del tipo CWE-754

507 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2020-5215MEDIUMSegmentation faultin TensorFlow when converting a Python string to tf.float16EPSS 0.6%CVE-2023-25620MEDIUM A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controllerEPSS 0.6%CVE-2025-4619MEDIUMPAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted PacketsEPSS 0.6%CVE-2022-43393HIGHAn improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70EPSS 0.6%CVE-2026-23991MEDIUMgo-tuf affected by client DoS via malformed server responseEPSS 0.6%CVE-2026-0229MEDIUMPAN-OS: Denial of Service in Advanced DNS Security FeatureEPSS 0.6%CVE-2024-40619HIGHRockwell Automation GuardLogix/ControlLogix 5580 Controller denial-of-service Vulnerability via Malformed Packet HandlingEPSS 0.6%CVE-2024-26008MEDIUMAn improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, ForEPSS 0.6%CVE-2018-25007LOWUnauthorized client-side property update in UIDL request handler in Vaadin 10 and 11EPSS 0.6%CVE-2025-32051MEDIUMLibsoup: segmentation fault when parsing malformed data uriEPSS 0.6%CVE-2024-45085MEDIUMIBM WebSphere Application Server denial of serviceEPSS 0.6%CVE-2022-3192MEDIUM Improper Check for Unusual or Exceptional ConditionsEPSS 0.6%CVE-2023-34348HIGHImproper Check or Handling of Exceptional Conditions in Aveva PI Server EPSS 0.6%CVE-2026-20776HIGHImproper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. NetwoEPSS 0.6%CVE-2024-4182MEDIUMMattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom statEPSS 0.6%CVE-2024-50284HIGHksmbd: Fix the missing xa_store error checkEPSS 0.5%CVE-2023-45922MEDIUMglx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is dispEPSS 0.5%CVE-2026-33151HIGHsocket.io allows an unbounded number of binary attachmentsEPSS 0.5%CVE-2025-13392HIGHImproper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3EPSS 0.5%CVE-2026-43194HIGHnet: consume xmit errors of GSO framesEPSS 0.5%