Falhas do tipo CWE-252

114 resultados

Retorno de função não verificado

O desenvolvedor chama uma função que pode falhar (retornando erro ou null), mas não verifica o resultado antes de usá-lo. O programa segue adiante assumindo sucesso, causando comportamento indefinido ou falha em cascata quando o retorno indicava problema.

Exemplo

Um código abre um arquivo com fopen() sem verificar se retornou NULL. Na linha seguinte, tenta ler do ponteiro inválido, causando crash ou comportamento imprevisível. Ou uma função de criptografia falha silenciosamente, e o código usa dados não-criptografados pensando que estão protegidos.

Como mitigar

Sempre verificar o retorno de funções críticas (alocação de memória, I/O, criptografia, validação). Use if/else, try-catch ou assertions conforme o padrão da linguagem. Ative avisos do compilador para funções marcadas como 'warn_unused_result'.

CVE-2024-39558HIGHJunos OS and Junos OS Evolved: Receipt of specific PIM packet causes rpd crash when PIM is configured along with MoFRREPSS 0.3%CVE-2026-86739LOWSnipe-IT before 8.7.0 Acceptance Finalization Without Stored EvidenceEPSS 0.3%CVE-2020-8934MEDIUMSite Kit by Google plugin for WordPressEPSS 0.2%CVE-2023-26591LOWUnchecked return value in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potenEPSS 0.2%CVE-2026-79772MEDIUMNokogiri before 1.19.1 Unchecked Return Value canonicalizeEPSS 0.2%CVE-2026-86749HIGHsnipe-it before 8.7.0 Data Loss via Failed Image WriteEPSS 0.2%CVE-2025-1394MEDIUMDenial of Service (DoS) vulnerabilitiey in Zigbee libraryEPSS 0.2%CVE-2026-31830HIGHsigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digestEPSS 0.2%CVE-2023-47480HIGHAn issue in Pure Data 0.54-0 and fixed in 0.54-1 allows a local attacker to escalate privileges via the set*id () function.EPSS 0.2%CVE-2022-3108MEDIUMAn issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check EPSS 0.2%CVE-2023-40067MEDIUMUnchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege viEPSS 0.2%CVE-2026-85649HIGH(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root uEPSS 0.2%CVE-2026-77641MEDIUMtor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_froEPSS 0.2%CVE-2026-21492MEDIUMiccDEV ToneMap Writer has NULL Pointer Member CallEPSS 0.2%CVE-2024-39492HIGHmailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdownEPSS 0.2%CVE-2026-21498MEDIUMNULL Pointer Dereference in iccDEV XML Calculator ParserEPSS 0.2%CVE-2026-21497MEDIUMNULL Pointer Dereference in iccDEV Unknown Tag ParserEPSS 0.2%CVE-2026-21496MEDIUMNULL Pointer Dereference in iccDEV Signature ParserEPSS 0.2%CVE-2026-21502MEDIUMNULL Pointer Dereference in iccDEV XML Tag ParserEPSS 0.2%CVE-2023-29243MEDIUMUnchecked return value in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow a priviledgeEPSS 0.2%