Fallos del tipo CWE-755

273 resultados

Tratamento inadequado de condições excepcionais

O código falha em capturar, validar ou responder corretamente a situações de erro ou exceção. Isso deixa o programa em estado inconsistente, pode expor informações sensíveis em mensagens de erro, ou permite que um atacante contorne controles de segurança explorando caminhos de exceção não previstos.

Ejemplo

Um sistema de login que lança uma exceção genérica quando o banco de dados falha, mas não a trata adequadamente — a stack trace é exibida na resposta HTTP, revelando arquitetura interna e caminhos do servidor. Ou um processamento de arquivo que não verifica se a leitura falhou antes de usar o conteúdo, causando comportamento indefinido.

Cómo mitigar

Sempre capture exceções esperadas com try-catch (ou equivalente na linguagem) e implemente tratamento específico para cada cenário de erro. Nunca expor stack traces ou detalhes técnicos ao usuário final; registre internamente e retorne mensagens genéricas. Valide o estado do programa após qualquer operação que possa falhar antes de prosseguir.

CVE-2024-47489MEDIUMJunos OS Evolved: ACX Series: Receipt of specific transit protocol packets is incorrectly processed by the REEPSS 0.7%CVE-2026-59162MEDIUMExcelize: Negative shared-string index causes panic in GetCellValue and GetRowsEPSS 0.7%CVE-2021-38363HIGHAn issue was discovered in ONOS 2.5.1. In IntentManager, the install-requested intent (which causes an exception) remains in pendingMap (in EPSS 0.7%CVE-2023-44186HIGHJunos OS and Junos OS Evolved: RPD crash when attempting to send a very long AS PATH to a non-4-byte-AS capable BGP neighborEPSS 0.6%CVE-2023-36832HIGHJunos OS: MX Series: PFE crash upon receipt of specific packet destined to an AMS interfaceEPSS 0.6%CVE-2024-6594HIGHWatchGuard Firebox Single Sign-On Client Denial-of-ServiceEPSS 0.6%CVE-2023-22391HIGHJunos OS: ACX2K Series: Receipt of a high rate of specific traffic will lead to a Denial of Service (DoS)EPSS 0.6%CVE-2026-112332HIGHMotor.NET < 0.19.0 Denial of Service via JsonNet DeserializationEPSS 0.6%CVE-2024-21585MEDIUMJunos OS and Junos OS Evolved: BGP session flaps on NSR-enabled devices can cause rpd crashEPSS 0.6%CVE-2023-41085HIGHBIG-IP IPSEC vulnerabilityEPSS 0.6%CVE-2022-39380MEDIUMwire-webapp contains Improper Handling of Exceptional Conditions leading to a DoS via Markdown RenderingEPSS 0.6%CVE-2024-47609MEDIUMRemotely exploitable DoS in Tonic `<=v0.12.2`EPSS 0.6%CVE-2024-41886MEDIUMImproper Input ValidationEPSS 0.6%CVE-2024-7521CRITICALIncomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14,EPSS 0.6%CVE-2023-24510HIGHOn the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.EPSS 0.6%CVE-2023-4537HIGHProtocol Downgrade in Comarch ERP XLEPSS 0.6%CVE-2026-52856HIGHWings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceEPSS 0.6%CVE-2026-81515HIGHSteeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)EPSS 0.6%CVE-2026-81516HIGHSteeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)EPSS 0.6%CVE-2026-54775MEDIUMCoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.EPSS 0.6%