Falhas do tipo CWE-248

291 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2023-6640MEDIUMSilicon Labs PC Controller v5.54.0 and Earlier Denial of Service VulnerabilityEPSS 0.3%CVE-2026-65834MEDIUMCapsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requestsEPSS 0.3%CVE-2019-10917—A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.EPSS 0.3%CVE-2026-81517HIGHMongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL ServiceEPSS 0.3%CVE-2026-47219HIGHfind-my-way is Vulnerable to DDoS with HTTP2EPSS 0.3%CVE-2022-3500MEDIUMA vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exEPSS 0.3%CVE-2026-82417MEDIUMqs.stringify throws TypeError on objects with a non-callable constructor.isBuffer propertyEPSS 0.3%CVE-2026-41585MEDIUMZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated ClientsEPSS 0.3%CVE-2026-27631LOWExiv2: Uncaught exception - cannot create std::vector larger than max_size()EPSS 0.3%CVE-2026-85024MEDIUMundici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionEPSS 0.3%CVE-2026-87123MEDIUMhbs vulnerable to Denial of Service via unhandled exception in async helper output escapingEPSS 0.3%CVE-2023-6533MEDIUMSilicon Labs PC Controller Denial of Service VulnerabilityEPSS 0.3%CVE-2025-24836MEDIUMQardio Heart Health IOS and Android Application and QardioARM A100 Uncaught ExceptionEPSS 0.2%CVE-2025-66578MEDIUMrobrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validationEPSS 0.2%CVE-2022-1975—There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-EPSS 0.2%CVE-2025-13064MEDIUMA server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by EPSS 0.2%CVE-2026-79778MEDIUMrclone before v1.75.0 Denial of Service via TUS nil-response panicEPSS 0.2%CVE-2026-61544HIGHlibp2p-quic: Remote panic via certificate expiry race during QUIC handshakeEPSS 0.2%CVE-2026-34944MEDIUMWasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64EPSS 0.2%CVE-2023-22292HIGHUncaught exception for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local acEPSS 0.2%