Fallos del tipo CWE-755

243 resultados

Tratamento inadequado de condições excepcionais

O código falha em capturar, validar ou responder corretamente a situações de erro ou exceção. Isso deixa o programa em estado inconsistente, pode expor informações sensíveis em mensagens de erro, ou permite que um atacante contorne controles de segurança explorando caminhos de exceção não previstos.

Ejemplo

Um sistema de login que lança uma exceção genérica quando o banco de dados falha, mas não a trata adequadamente — a stack trace é exibida na resposta HTTP, revelando arquitetura interna e caminhos do servidor. Ou um processamento de arquivo que não verifica se a leitura falhou antes de usar o conteúdo, causando comportamento indefinido.

Cómo mitigar

Sempre capture exceções esperadas com try-catch (ou equivalente na linguagem) e implemente tratamento específico para cada cenário de erro. Nunca expor stack traces ou detalhes técnicos ao usuário final; registre internamente e retorne mensagens genéricas. Valide o estado do programa após qualquer operação que possa falhar antes de prosseguir.

CVE-2024-32652HIGH@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsedEPSS 0.9%CVE-2021-4105CRITICALUnauthenticated Remote Code Execution on COSLAT FirewallEPSS 0.9%CVE-2022-20920HIGHCisco IOS and IOS XE Software SSH Denial of Service VulnerabilityEPSS 0.9%CVE-2023-40184LOWImproper handling of session establishment errors in xrdpEPSS 0.9%CVE-2023-46673MEDIUMIt was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when EPSS 0.8%CVE-2021-21592LOWDell EMC PowerScale OneFS versions 8.2.x - 9.2.x improperly handle an exceptional condition. A remote low privileged user could potentially EPSS 0.8%CVE-2022-46403HIGHThe Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages.EPSS 0.8%CVE-2022-29617—Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the applicationEPSS 0.8%CVE-2022-47933MEDIUMBrave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme.EPSS 0.8%CVE-2022-32264HIGHsys/netinet/tcp_timer.h in FreeBSD before 7.0 contains a denial-of-service (DoS) vulnerability due to improper handling of TSopt on TCP connEPSS 0.8%CVE-2023-41317HIGHUnnamed "Subscription" operation results in Denial-of-Service in apollographql/routerEPSS 0.8%CVE-2021-43827MEDIUMInline footnotes wrapped in <a> tags can cause errors in discourse-footnotesEPSS 0.8%CVE-2024-3150HIGHPrivilege Escalation in mintplex-labs/anything-llmEPSS 0.8%CVE-2025-34193HIGHVasion Print (formerly PrinterLogic) Insecure Windows Components Lack Modern Memory Protections and Use Outdated RuntimesEPSS 0.8%CVE-2022-23496HIGHA crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa EPSS 0.8%CVE-2024-23325HIGHEnvoy crashes when using an address type that isn’t supported by the OSEPSS 0.8%CVE-2024-8376HIGHMemory leakEPSS 0.7%CVE-2024-20699MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 0.7%CVE-2023-27595MEDIUMCilium eBPF filters may be temporarily removed during agent restartEPSS 0.7%CVE-2021-0297MEDIUMJunos OS Evolved: BGP and LDP sessions with TCP MD5 authentication established with peers not configured for authenticationEPSS 0.7%