Falhas do tipo CWE-248

381 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2026-121386HIGHFreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image ReadersEPSS 0.3%CVE-2019-10917—A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.EPSS 0.3%CVE-2022-3500MEDIUMA vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exEPSS 0.3%CVE-2026-79833HIGHHPE NonStop ANSI SQLUTIL - Denial of Service vulnerabilityEPSS 0.3%CVE-2026-110854HIGHParse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email ErrorEPSS 0.3%CVE-2026-87029MEDIUMundici vulnerable to Denial of Service via unhandled exception in the decompress interceptorEPSS 0.3%CVE-2026-41585MEDIUMZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated ClientsEPSS 0.3%CVE-2026-89315MEDIUMJwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffixEPSS 0.3%CVE-2023-6533MEDIUMSilicon Labs PC Controller Denial of Service VulnerabilityEPSS 0.3%CVE-2026-89318MEDIUMJweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)EPSS 0.2%CVE-2026-78243LOWApache YuniKorn: LDAP Group provider panics on lowercase attribute nameEPSS 0.2%CVE-2025-24836MEDIUMQardio Heart Health IOS and Android Application and QardioARM A100 Uncaught ExceptionEPSS 0.2%CVE-2022-1975—There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-EPSS 0.2%CVE-2025-13064MEDIUMA server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by EPSS 0.2%CVE-2025-66578MEDIUMrobrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validationEPSS 0.2%CVE-2026-107214HIGHExcelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooksEPSS 0.2%CVE-2026-34944MEDIUMWasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64EPSS 0.2%CVE-2026-107382MEDIUMMariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLSEPSS 0.2%CVE-2023-22292HIGHUncaught exception for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local acEPSS 0.2%CVE-2024-13417MEDIUMSpecifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully wEPSS 0.2%