Falhas do tipo CWE-252

130 resultados

Retorno de função não verificado

O desenvolvedor chama uma função que pode falhar (retornando erro ou null), mas não verifica o resultado antes de usá-lo. O programa segue adiante assumindo sucesso, causando comportamento indefinido ou falha em cascata quando o retorno indicava problema.

Exemplo

Um código abre um arquivo com fopen() sem verificar se retornou NULL. Na linha seguinte, tenta ler do ponteiro inválido, causando crash ou comportamento imprevisível. Ou uma função de criptografia falha silenciosamente, e o código usa dados não-criptografados pensando que estão protegidos.

Como mitigar

Sempre verificar o retorno de funções críticas (alocação de memória, I/O, criptografia, validação). Use if/else, try-catch ou assertions conforme o padrão da linguagem. Ative avisos do compilador para funções marcadas como 'warn_unused_result'.

CVE-2026-111497CRITICALOut-of-Bounds Write in Google Brotli DecoderEPSS 82.6%CVE-2007-3798CRITICALInteger overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafEPSS 70.4%CVE-2018-14622MEDIUMA null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked iEPSS 3.9%CVE-2020-17533—Apache Accumulo Improper Handling of Insufficient PermissionsEPSS 3.7%CVE-2021-4189MEDIUMA flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTPEPSS 3.4%CVE-2002-1372HIGHCommon Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, whEPSS 3.0%CVE-2024-35235MEDIUMCupsd Listen arbitrary chmod 0140777EPSS 2.4%CVE-2021-42780—A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the liEPSS 2.2%CVE-2020-6152CRITICALA code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A specially crafted malfoEPSS 1.9%CVE-2022-23476HIGHUnchecked return value from xmlTextReaderExpand in NokogiriEPSS 1.8%CVE-2022-1319—A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flEPSS 1.7%CVE-2024-50306CRITICALApache Traffic Server: Server process can fail to drop privilegeEPSS 1.6%CVE-2023-6918LOWLibssh: missing checks for return values for digestsEPSS 1.4%CVE-2021-40401CRITICALA use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd)EPSS 1.3%CVE-2024-0743HIGHAn unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122,EPSS 1.3%CVE-2022-31089HIGHInvalid file request can crashe parse-serverEPSS 1.2%CVE-2022-40716MEDIUMHashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPEPSS 1.1%CVE-2021-41041—In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is EPSS 1.1%CVE-2026-0723HIGHUnchecked Return Value in GitLabEPSS 1.0%CVE-2022-0485—A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blEPSS 1.0%