Falhas do tipo CWE-252

130 resultados

Retorno de função não verificado

O desenvolvedor chama uma função que pode falhar (retornando erro ou null), mas não verifica o resultado antes de usá-lo. O programa segue adiante assumindo sucesso, causando comportamento indefinido ou falha em cascata quando o retorno indicava problema.

Exemplo

Um código abre um arquivo com fopen() sem verificar se retornou NULL. Na linha seguinte, tenta ler do ponteiro inválido, causando crash ou comportamento imprevisível. Ou uma função de criptografia falha silenciosamente, e o código usa dados não-criptografados pensando que estão protegidos.

Como mitigar

Sempre verificar o retorno de funções críticas (alocação de memória, I/O, criptografia, validação). Use if/else, try-catch ou assertions conforme o padrão da linguagem. Ative avisos do compilador para funções marcadas como 'warn_unused_result'.

CVE-2024-1545MEDIUMFault Injection of RSA encryption in WolfCryptEPSS 0.6%CVE-2023-37902MEDIUMVyper's ecrecover can return undefined data if signature does not verifyEPSS 0.6%CVE-2026-26080LOWHAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALEPSS 0.5%CVE-2025-46672LOWNASA CryptoLib before 1.3.2 does not check the OTAR crypto function returned status, potentially leading to spacecraft hijacking.EPSS 0.5%CVE-2024-38427HIGHIn International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTaEPSS 0.5%CVE-2026-35468MEDIUMnimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history indexEPSS 0.5%CVE-2024-45419HIGHZoom Apps - Improper Input ValidationEPSS 0.5%CVE-2026-48741HIGHlibIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoSEPSS 0.5%CVE-2022-25718CRITICALCryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon ConnectivityEPSS 0.5%CVE-2026-21920HIGHJunos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crashEPSS 0.5%CVE-2025-66565CRITICALFiber Utils UUIDv4 and UUID Silent Fallback to Predictable ValuesEPSS 0.5%CVE-2026-14957HIGHFIPS mode assertion failure via malicious CERT payloadEPSS 0.5%CVE-2024-2881MEDIUMFault Injection of EdDSA signature in WolfCryptEPSS 0.5%CVE-2026-77207HIGHNull Pointer Dereference in PKCS#7 bundle with no certificatesEPSS 0.5%CVE-2026-29905MEDIUMKirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformedEPSS 0.5%CVE-2026-48503HIGHlibIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileReadEPSS 0.5%CVE-2026-33983MEDIUMFreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoSEPSS 0.4%CVE-2025-62785MEDIUMWazuh fillData NULL pointer dereference causes analysisd crashEPSS 0.4%CVE-2024-8110HIGHDenial of Service (DoS) vulnerability has been found in Dual-redundant Platform for Computer. If a computer on which the affected product isEPSS 0.4%CVE-2021-31366MEDIUMJunos OS: MX Series: In subscriber management / BBE configuration authd can crash if a subscriber with a specific username tries to login leading to a DoSEPSS 0.4%