Fallos del tipo CWE-755

243 resultados

Tratamento inadequado de condições excepcionais

O código falha em capturar, validar ou responder corretamente a situações de erro ou exceção. Isso deixa o programa em estado inconsistente, pode expor informações sensíveis em mensagens de erro, ou permite que um atacante contorne controles de segurança explorando caminhos de exceção não previstos.

Ejemplo

Um sistema de login que lança uma exceção genérica quando o banco de dados falha, mas não a trata adequadamente — a stack trace é exibida na resposta HTTP, revelando arquitetura interna e caminhos do servidor. Ou um processamento de arquivo que não verifica se a leitura falhou antes de usar o conteúdo, causando comportamento indefinido.

Cómo mitigar

Sempre capture exceções esperadas com try-catch (ou equivalente na linguagem) e implemente tratamento específico para cada cenário de erro. Nunca expor stack traces ou detalhes técnicos ao usuário final; registre internamente e retorne mensagens genéricas. Valide o estado do programa após qualquer operação que possa falhar antes de prosseguir.

CVE-2022-32657MEDIUMIn Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege wiEPSS 0.3%CVE-2022-32659MEDIUMIn Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege wiEPSS 0.3%CVE-2022-32658MEDIUMIn Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege wiEPSS 0.3%CVE-2022-0264—A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be retEPSS 0.3%CVE-2022-21218MEDIUMUncaught exception in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable EPSS 0.3%CVE-2026-54580HIGHmport index decompression can leave partial or corrupt index data after zstd failuresEPSS 0.3%CVE-2024-39560HIGHJunos OS and Junos OS Evolved: Memory leak due to RSVP neighbor persistent error leading to kernel crashEPSS 0.2%CVE-2026-63450LOWSuricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detectionEPSS 0.2%CVE-2025-21602HIGHJunos OS and Junos OS Evolved: Receipt of specially crafted BGP update packet causes RPD crashEPSS 0.2%CVE-2023-5090MEDIUMKernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrsEPSS 0.2%CVE-2024-50202MEDIUMnilfs2: propagate directory read errors from nilfs_find_entry()EPSS 0.2%CVE-2021-29617LOWCrash in `tf.strings.substr` due to `CHECK`-failEPSS 0.2%CVE-2023-24308HIGHA potential memory vulnerability due to insufficient input validation in PDFXEditCore.x64.dll in PDF-XChange Editor version 9.3 by Tracker SEPSS 0.2%CVE-2021-29618LOWCrash in `tf.transpose` with complex inputsEPSS 0.2%CVE-2024-0108HIGHNVIDIA Jetson Linux contains a vulnerability in NvGPU where error handling paths in GPU MMU mapping code fail to clean up a failed mapping aEPSS 0.2%CVE-2024-50176MEDIUMremoteproc: k3-r5: Fix error handling when power-up failedEPSS 0.2%CVE-2026-42545MEDIUMGranian: DoS via WSGI response header panicEPSS 0.2%CVE-2021-23886MEDIUMLocal Denial of Service in McAfee DLP Endpoint for WindowsEPSS 0.2%CVE-2025-53702HIGHDoS vulnerability in Vilar VS-IPC1002 IP camerasEPSS 0.2%CVE-2022-48619MEDIUMAn issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) becauEPSS 0.2%