Fallos del tipo CWE-755

232 resultados

Tratamento inadequado de condições excepcionais

O código falha em capturar, validar ou responder corretamente a situações de erro ou exceção. Isso deixa o programa em estado inconsistente, pode expor informações sensíveis em mensagens de erro, ou permite que um atacante contorne controles de segurança explorando caminhos de exceção não previstos.

Ejemplo

Um sistema de login que lança uma exceção genérica quando o banco de dados falha, mas não a trata adequadamente — a stack trace é exibida na resposta HTTP, revelando arquitetura interna e caminhos do servidor. Ou um processamento de arquivo que não verifica se a leitura falhou antes de usar o conteúdo, causando comportamento indefinido.

Cómo mitigar

Sempre capture exceções esperadas com try-catch (ou equivalente na linguagem) e implemente tratamento específico para cada cenário de erro. Nunca expor stack traces ou detalhes técnicos ao usuário final; registre internamente e retorne mensagens genéricas. Valide o estado do programa após qualquer operação que possa falhar antes de prosseguir.

CVE-2017-5638CRITICALThe Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mesEPSS 100.0%KEVCVE-2020-7247CRITICALsmtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary coEPSS 98.9%KEVCVE-2021-28165HIGHIn Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invaEPSS 53.9%CVE-2021-38003HIGHInappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption vEPSS 38.6%KEVCVE-2019-6848—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication modEPSS 33.0%CVE-2024-21907HIGHImproper Handling of Exceptional Conditions in Newtonsoft.JsonEPSS 32.9%CVE-2019-6841—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon EPSS 24.4%CVE-2025-43864HIGHReact Router allows a DoS via cache poisoning by forcing SPA modeEPSS 20.2%CVE-2022-23121CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required tEPSS 8.6%CVE-2023-5824HIGHSquid: dos against http and httpsEPSS 5.2%CVE-2019-10222HIGHA flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crashEPSS 4.6%CVE-2024-34750HIGHApache Tomcat: HTTP/2 excess header handling DoSEPSS 4.6%CVE-2021-28831HIGHdecompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or seEPSS 2.7%CVE-2021-34593HIGHCODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-serviceEPSS 2.6%CVE-2021-46828HIGHIn libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connectionEPSS 2.6%CVE-2020-15117MEDIUMDenial of Service in SynergyEPSS 2.5%CVE-2021-39157HIGHImproper Handling of Exceptional Conditions in detect-character-encodingEPSS 2.1%CVE-2021-25662HIGHA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 1.6%CVE-2022-21667HIGHDenial of Service in soketiEPSS 1.6%CVE-2020-15223HIGHIgnored storage errors on token revokation in ORY FositeEPSS 1.6%