Falhas do tipo CWE-248

291 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2026-42545MEDIUMGranian: DoS via WSGI response header panicEPSS 0.2%CVE-2024-13417MEDIUMSpecifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully wEPSS 0.2%CVE-2021-3038MEDIUMGlobalProtect App: Windows VPN kernel driver denial of service (DoS)EPSS 0.2%CVE-2023-23774HIGHMotorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt onEPSS 0.2%CVE-2026-49096MEDIUMUncaught Exception in Kibana Cases Leading to Denial of ServiceEPSS 0.2%CVE-2026-44905HIGHVanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic VerificationEPSS 0.2%CVE-2026-84947LOWundici vulnerable to response truncation via oversized chunked responses in the dump interceptorEPSS 0.2%CVE-2021-33145HIGHUncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged usEPSS 0.2%CVE-2026-55244MEDIUMASTEVAL: Sandbox Escape via BaseException SubclassesEPSS 0.2%CVE-2026-43988HIGHVanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER ParsingEPSS 0.2%CVE-2024-29076MEDIUMUncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of sEPSS 0.2%CVE-2025-20054MEDIUMUncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable deniaEPSS 0.2%CVE-2025-8870MEDIUMOn affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.EPSS 0.2%CVE-2024-32995MEDIUMDenial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.2%CVE-2026-45676MEDIUMOpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agentEPSS 0.2%CVE-2024-33848MEDIUMUncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of servicEPSS 0.1%CVE-2025-0158MEDIUMIBM EntireX denial of serviceEPSS 0.1%CVE-2026-35348MEDIUMuutils coreutils sort Local Denial of Service via Forced UTF-8 ParsingEPSS 0.1%CVE-2025-15649MEDIUMIO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS dateEPSS 0.1%CVE-2024-42037CRITICALVulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confideEPSS 0.1%