Falhas do tipo CWE-391
24 resultadosCondição de erro não verificada
Ocorre quando o código não valida o resultado de uma operação que pode falhar (como leitura de arquivo, alocação de memória ou chamada a API), assumindo que sempre funcionará. Se a operação falha silenciosamente, o programa continua com dados inválidos ou indefinidos, causando comportamento impredizível ou exploração de segurança.
Exemplo
Um aplicativo tenta conectar a um banco de dados remoto sem checar se a conexão foi bem-sucedida, depois tenta fazer queries no objeto de conexão nulo. A falha fica invisível até o crash ou um erro genérico aparecer.
Como mitigar
Sempre verifique o retorno de operações críticas (I/O, rede, alocação): compare contra valores de erro, use try-catch, ou padrões como Optional/Result. Registre erros em log e defina um comportamento seguro quando algo falhar (fail-safe).
CVE-2024-52316CRITICALApache Tomcat: Authentication bypass when using Jakarta Authentication APIEPSS 6.3%CVE-2017-12177—xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X serEPSS 4.4%CVE-2017-12179—xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to EPSS 4.4%CVE-2017-12186—xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash oEPSS 4.3%CVE-2017-12181—xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash EPSS 4.2%CVE-2017-12183—xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or poEPSS 4.2%CVE-2017-12182—xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash EPSS 4.2%CVE-2017-12180—xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to craEPSS 4.2%CVE-2017-12184—xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or EPSS 4.2%CVE-2017-12185—xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to cEPSS 4.2%CVE-2017-12176—xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause XEPSS 4.2%CVE-2017-12178—xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server tEPSS 4.2%CVE-2017-12187—xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or poEPSS 3.3%CVE-2019-14853LOWAn error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexEPSS 2.5%CVE-2020-14383—A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also seEPSS 2.2%CVE-2016-10526—A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth pEPSS 1.6%CVE-2023-0572MEDIUMUnchecked Error Condition in froxlor/froxlorEPSS 0.7%CVE-2025-71325CRITICALpicklescan - Detection Bypass via STACK_GLOBAL Opcode Parsing Logic FlawEPSS 0.5%CVE-2018-1091—In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggeEPSS 0.4%CVE-2022-22160MEDIUMJunos OS: MX Series: The bbe-smgd process crashes if an unsupported configuration exists and a PPPoE client sends a specific messageEPSS 0.4%