Falhas do tipo CWE-248

291 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2019-7474—A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloaEPSS 0.7%CVE-2023-22290MEDIUMUncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network accessEPSS 0.7%CVE-2024-58368HIGHSurrealDB before 1.1.0 Denial of Service via HTTP HeadersEPSS 0.7%CVE-2023-20086HIGHA vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software cEPSS 0.7%CVE-2026-34986HIGHGo JOSE affect by a panic in JWE decryptionEPSS 0.7%CVE-2025-20637HIGHIn network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional EPSS 0.6%CVE-2026-32641HIGHParseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middlewareEPSS 0.6%CVE-2024-8020HIGHDenial of Service in lightning-ai/pytorch-lightningEPSS 0.6%CVE-2023-42447HIGHblurhash panics on parsing crafted inputsEPSS 0.6%CVE-2026-48068HIGH@grpc/grps-js: A malformed request can cause a server crashEPSS 0.6%CVE-2026-33939HIGHHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationEPSS 0.6%CVE-2026-58208MEDIUMNATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is EnabledEPSS 0.6%CVE-2026-54775MEDIUMCoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.EPSS 0.6%CVE-2024-43367HIGHBoa has an uncaught exception when transitioning the state of `AsyncGenerator` objectsEPSS 0.6%CVE-2025-32944MEDIUMPeerTube User Import Authenticated Persistent Denial of ServiceEPSS 0.6%CVE-2026-77781HIGHTie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keysEPSS 0.6%CVE-2026-25128HIGHfast-xml-parser has RangeError DoS Numeric Entities BugEPSS 0.6%CVE-2026-82410HIGHPocketbase: Unhandled panic in worker goroutinesEPSS 0.6%CVE-2025-35436MEDIUMCISA Thorium account verification email error handlingEPSS 0.6%CVE-2026-32770MEDIUMParse Server: LiveQuery subscription with invalid regular expression crashes serverEPSS 0.5%