Falhas do tipo CWE-248

243 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2025-59538HIGHArgo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookEPSS 8.3%CVE-2021-37714HIGHCrafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptionsEPSS 6.9%CVE-2025-53366HIGHMCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of ServiceEPSS 6.0%CVE-2018-11466—A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versEPSS 4.0%CVE-2025-59465HIGHA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` erEPSS 3.6%CVE-2018-7852HIGHA CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium wEPSS 3.6%CVE-2020-6019—Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBaEPSS 2.8%CVE-2020-10604—In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through speciEPSS 2.1%CVE-2022-41940HIGHUncaught exception in engine.io EPSS 1.9%CVE-2018-11464—A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HFEPSS 1.9%CVE-2019-6809—A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions priorEPSS 1.8%CVE-2019-6575HIGHA vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUSEPSS 1.6%CVE-2022-24822HIGHDenial of Service in @podium/layout and @podium/proxyEPSS 1.6%CVE-2019-6829HIGHA CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prioEPSS 1.6%CVE-2020-15796—A vulnerability has been identified in SIMATIC ET 200SP Open Controller (incl. SIPLUS variants) (V20.8), SIMATIC S7-1500 Software ControllerEPSS 1.6%CVE-2019-6828—A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to VEPSS 1.5%CVE-2019-10931—A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet commuEPSS 1.5%CVE-2020-10292HIGHService DoS through arbitrary pointer dereferencing on KUKA simulatorEPSS 1.5%CVE-2022-31015MEDIUMUncaught Exception (due to a data race) leads to process termination in WaitressEPSS 1.4%CVE-2025-3891HIGHMod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabledEPSS 1.4%