Falhas do tipo CWE-248

381 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2021-3038MEDIUMGlobalProtect App: Windows VPN kernel driver denial of service (DoS)EPSS 0.2%CVE-2023-23774HIGHMotorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt onEPSS 0.2%CVE-2026-89316MEDIUMLoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertionEPSS 0.2%CVE-2026-44905HIGHVanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic VerificationEPSS 0.2%CVE-2021-33145HIGHUncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged usEPSS 0.2%CVE-2026-84947LOWundici vulnerable to response truncation via oversized chunked responses in the dump interceptorEPSS 0.2%CVE-2025-20054MEDIUMUncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable deniaEPSS 0.2%CVE-2026-87018HIGHundici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationEPSS 0.2%CVE-2026-43988HIGHVanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER ParsingEPSS 0.2%CVE-2026-102511HIGHApache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from themEPSS 0.2%CVE-2024-29076MEDIUMUncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of sEPSS 0.2%CVE-2025-8870MEDIUMOn affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.EPSS 0.2%CVE-2026-55244MEDIUMASTEVAL: Sandbox Escape via BaseException SubclassesEPSS 0.2%CVE-2024-32995MEDIUMDenial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.2%CVE-2026-45676MEDIUMOpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agentEPSS 0.2%CVE-2026-101175MEDIUMNull pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.2%CVE-2026-96274HIGHUncaught exception in Baicells Nova 430HEPSS 0.2%CVE-2026-12067—AvastSvc denial of service via unhandled JsonCpp exceptions in native message handlersEPSS 0.2%CVE-2026-80303—Avast WFP stream parser integer underflow causes system crashEPSS 0.2%CVE-2024-33848MEDIUMUncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of servicEPSS 0.1%