Fallos del tipo CWE-755

243 resultados

Tratamento inadequado de condições excepcionais

O código falha em capturar, validar ou responder corretamente a situações de erro ou exceção. Isso deixa o programa em estado inconsistente, pode expor informações sensíveis em mensagens de erro, ou permite que um atacante contorne controles de segurança explorando caminhos de exceção não previstos.

Ejemplo

Um sistema de login que lança uma exceção genérica quando o banco de dados falha, mas não a trata adequadamente — a stack trace é exibida na resposta HTTP, revelando arquitetura interna e caminhos do servidor. Ou um processamento de arquivo que não verifica se a leitura falhou antes de usar o conteúdo, causando comportamento indefinido.

Cómo mitigar

Sempre capture exceções esperadas com try-catch (ou equivalente na linguagem) e implemente tratamento específico para cada cenário de erro. Nunca expor stack traces ou detalhes técnicos ao usuário final; registre internamente e retorne mensagens genéricas. Valide o estado do programa após qualquer operação que possa falhar antes de prosseguir.

CVE-2022-32655MEDIUMIn Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege wiEPSS 0.3%CVE-2024-30380HIGHJunos OS and Junos OS Evolved: l2cpd crash upon receipt of a specific TLVEPSS 0.3%CVE-2020-2020MEDIUMCortex XDR Agent: Exceptional condition denial-of-service (DoS)EPSS 0.3%CVE-2023-28768MEDIUMImproper frame handling in the Zyxel XGS2220-30 firmware version V4.80(ABXN.1), XMG1930-30 firmware version V4.80(ACAR.1), and XS1930-10 firEPSS 0.3%CVE-2026-59952MEDIUMValibot: record() issue paths can make flatten() throw for inherited Object property namesEPSS 0.3%CVE-2025-48886MEDIUMhydra-node dangerously assumes L1 event finality and does not consider failed transactionsEPSS 0.3%CVE-2020-5387LOWDell XPS 13 9370 BIOS versions prior to 1.13.1 contains an Improper Exception Handling vulnerability. A local attacker with physical access EPSS 0.3%CVE-2026-44505MEDIUMNimiq network-libp2p: Untrusted peer can wedge DHTEPSS 0.3%CVE-2020-2505LOWSensitive information via generation of error messages vulnerability in QESEPSS 0.3%CVE-2026-48036HIGHHulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdictsEPSS 0.3%CVE-2026-30798HIGHRustDesk Client Accepts Unauthenticated stop-service Command via Strategy PayloadEPSS 0.3%CVE-2025-41222MEDIUMA vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCOEPSS 0.3%CVE-2024-53063HIGHmedia: dvbdev: prevent the risk of out of memory accessEPSS 0.3%CVE-2024-21587MEDIUMJunos OS: MX Series: Memory leak in bbe-smgd process if BFD liveness detection for DHCP subscribers is enabledEPSS 0.3%CVE-2021-0190HIGHUncaught exception in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privilEPSS 0.3%CVE-2026-0203HIGHJunos OS: Receipt of a specifically malformed ICMP packet causes an FPC restartEPSS 0.3%CVE-2026-27586HIGHCaddy's mTLS client authentication silently fails open when CA certificate file is missing or malformedEPSS 0.3%CVE-2026-48961HIGHIO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GIDEPSS 0.3%CVE-2025-52947HIGHJunos OS: ACX Series: When 'hot-standby' mode is configured for an L2 circuit, interface flap causes the FEB to crashEPSS 0.3%CVE-2020-25236MEDIUMA vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versionEPSS 0.3%