Fallos del tipo CWE-755

243 resultados

Tratamento inadequado de condições excepcionais

O código falha em capturar, validar ou responder corretamente a situações de erro ou exceção. Isso deixa o programa em estado inconsistente, pode expor informações sensíveis em mensagens de erro, ou permite que um atacante contorne controles de segurança explorando caminhos de exceção não previstos.

Ejemplo

Um sistema de login que lança uma exceção genérica quando o banco de dados falha, mas não a trata adequadamente — a stack trace é exibida na resposta HTTP, revelando arquitetura interna e caminhos do servidor. Ou um processamento de arquivo que não verifica se a leitura falhou antes de usar o conteúdo, causando comportamento indefinido.

Cómo mitigar

Sempre capture exceções esperadas com try-catch (ou equivalente na linguagem) e implemente tratamento específico para cada cenário de erro. Nunca expor stack traces ou detalhes técnicos ao usuário final; registre internamente e retorne mensagens genéricas. Valide o estado do programa após qualquer operação que possa falhar antes de prosseguir.

CVE-2022-1965HIGHCODESYS runtime system prone to file deletion due to improper error handlingEPSS 1.1%CVE-2021-31361MEDIUMJunos OS: QFX Series and PTX Series: FPC resource usage increases when certain packets are processed which are being VXLAN encapsulatedEPSS 1.0%CVE-2024-28869HIGHPossible denial of service vulnerability with Content-length header in TraefikEPSS 1.0%CVE-2021-22285HIGHSECURITY – Denial of Service Vulnerabilities in SPIET800 INFI-Net to Ethernet Transfer module and PNI800 S+ Ethernet communication interface moduleEPSS 1.0%CVE-2022-3279LOWAn unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15EPSS 1.0%CVE-2021-0299HIGHJunos OS: Kernel crash (vmcore) upon receipt of a malformed IPv6 packetEPSS 1.0%CVE-2021-3053HIGHPAN-OS: Exceptional Condition Denial-of-Service (DoS)EPSS 1.0%CVE-2022-23161HIGHDell PowerScale OneFS versions 8.2.x - 9.3.0.x contain a denial-of-service vulnerability in SmartConnect. An unprivileged network attacker mEPSS 1.0%CVE-2024-39547HIGHJunos OS and Junos OS Evolved: cRPD: Receipt of crafted TCP traffic can trigger high CPU utilizationEPSS 1.0%CVE-2021-32999HIGHAVEVA SuiteLink Server Improper Handling of Exceptional ConditionsEPSS 1.0%CVE-2019-6843—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon EPSS 1.0%CVE-2019-6847—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modulesEPSS 1.0%CVE-2019-6844—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modulesEPSS 1.0%CVE-2019-6842—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modulesEPSS 1.0%CVE-2022-22177MEDIUMJunos OS and Junos OS Evolved: After receiving a specific number of crafted packets snmpd will segmentation fault (SIGSEGV) requiring a manual restart.EPSS 1.0%CVE-2022-36031MEDIUMUnhandled exception on illegal filename_disk valueEPSS 0.9%CVE-2022-48329CRITICALMISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/MEPSS 0.9%CVE-2021-3063HIGHPAN-OS: Denial-of-Service (DoS) Vulnerability in GlobalProtect Portal and Gateway InterfacesEPSS 0.9%CVE-2022-22174HIGHJunos OS: QFX5000 Series, EX4600: Device may run out of memory, causing traffic loss, upon receipt of specific IPv6 packetsEPSS 0.9%CVE-2022-23018—On BIG-IP AFM version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and 13.1.x beginning in 13.1.3.4, when a virtualEPSS 0.9%