Falhas do tipo CWE-252

101 resultados

Retorno de função não verificado

O desenvolvedor chama uma função que pode falhar (retornando erro ou null), mas não verifica o resultado antes de usá-lo. O programa segue adiante assumindo sucesso, causando comportamento indefinido ou falha em cascata quando o retorno indicava problema.

Exemplo

Um código abre um arquivo com fopen() sem verificar se retornou NULL. Na linha seguinte, tenta ler do ponteiro inválido, causando crash ou comportamento imprevisível. Ou uma função de criptografia falha silenciosamente, e o código usa dados não-criptografados pensando que estão protegidos.

Como mitigar

Sempre verificar o retorno de funções críticas (alocação de memória, I/O, criptografia, validação). Use if/else, try-catch ou assertions conforme o padrão da linguagem. Ative avisos do compilador para funções marcadas como 'warn_unused_result'.

CVE-2007-3798CRITICALInteger overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafEPSS 70.4%CVE-2018-14622MEDIUMA null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked iEPSS 3.9%CVE-2020-17533—Apache Accumulo Improper Handling of Insufficient PermissionsEPSS 3.7%CVE-2002-1372HIGHCommon Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, whEPSS 3.0%CVE-2021-4189MEDIUMA flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTPEPSS 2.7%CVE-2024-35235MEDIUMCupsd Listen arbitrary chmod 0140777EPSS 2.4%CVE-2021-42780—A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the liEPSS 2.1%CVE-2020-6152CRITICALA code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A specially crafted malfoEPSS 1.9%CVE-2022-23476HIGHUnchecked return value from xmlTextReaderExpand in NokogiriEPSS 1.7%CVE-2024-50306CRITICALApache Traffic Server: Server process can fail to drop privilegeEPSS 1.6%CVE-2023-6918LOWLibssh: missing checks for return values for digestsEPSS 1.4%CVE-2021-40401CRITICALA use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd)EPSS 1.3%CVE-2024-0743HIGHAn unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122,EPSS 1.3%CVE-2022-1319—A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flEPSS 1.3%CVE-2022-31089HIGHInvalid file request can crashe parse-serverEPSS 1.1%CVE-2021-41041—In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is EPSS 1.0%CVE-2023-24825HIGHRIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_markEPSS 1.0%CVE-2021-37625HIGHIncorrect Check of Function Return Value in SkytableEPSS 0.9%CVE-2021-34585HIGHCODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)EPSS 0.9%CVE-2022-40716MEDIUMHashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPEPSS 0.9%