Falhas do tipo CWE-248

379 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2026-27819HIGHVikunja has Path Traversal in CLI RestoreEPSS 0.8%CVE-2026-88099MEDIUMWindows Failover Cluster Denial of Service VulnerabilityEPSS 0.8%CVE-2025-23166HIGHThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background tEPSS 0.8%CVE-2025-47944HIGHMulter vulnerable to Denial of Service from maliciously crafted requestsEPSS 0.8%CVE-2025-7338HIGHMulter vulnerable to Denial of Service via unhandled exception from malformed requestEPSS 0.8%CVE-2020-14348—It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the user namespace puts AMEPSS 0.8%CVE-2025-20171HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%CVE-2023-4785HIGHDenial of Service in gRPC CoreEPSS 0.8%CVE-2025-20172HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, EPSS 0.8%CVE-2025-20173HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%CVE-2025-20176HIGHA vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to causeEPSS 0.8%CVE-2024-23325HIGHEnvoy crashes when using an address type that isn’t supported by the OSEPSS 0.8%CVE-2023-23932MEDIUMSpecially crafted RTPS message may cause an OpenDDS application to crashEPSS 0.7%CVE-2024-31217MEDIUM@strapi/plugin-upload has a Denial-of-Service via Improper Exception HandlingEPSS 0.7%CVE-2024-11738MEDIUMRustls: rustls network-reachable panic in `acceptor::accept`EPSS 0.7%CVE-2023-0158HIGHTriggered crash on direct RRDP accessEPSS 0.7%CVE-2022-38166HIGHIn F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler cEPSS 0.7%CVE-2023-0790HIGHUncaught Exception in thorsten/phpmyfaqEPSS 0.7%CVE-2026-64612HIGHLibcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed pngEPSS 0.7%CVE-2023-27318MEDIUMDenial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) EPSS 0.7%