Falhas do tipo CWE-476

2.331 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2022-36661MEDIUMxhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_read(). This vulnerability allows attackeEPSS 0.8%CVE-2022-42928HIGHCertain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corrEPSS 0.8%CVE-2024-23080CRITICALJoda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NEPSS 0.8%CVE-2020-27819—An issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files. A NULL pointer dereference vulnerability exEPSS 0.8%CVE-2026-70575MEDIUMWindows Schannel Denial of Service VulnerabilityEPSS 0.8%CVE-2022-42527HIGHIn cd_SsParseMsg of cd_SsCodec.c, there is a possible crash due to a missing null check. This could lead to remote denial of service with noEPSS 0.8%CVE-2024-26731MEDIUMbpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()EPSS 0.8%CVE-2025-32818HIGHA Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker to crash tEPSS 0.8%CVE-2019-1010162—jsish 2.4.74 2.0474 is affected by: CWE-476: NULL Pointer Dereference. The impact is: denial of service. The component is: function Jsi_StrcEPSS 0.8%CVE-2026-73547HIGHEnvoy ext_authz: request `:path` pseudoheader dereferenced w/o null checkEPSS 0.8%CVE-2022-0890MEDIUMNULL Pointer Dereference in mruby/mrubyEPSS 0.8%CVE-2025-32913HIGHLibsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in content-disposition headerEPSS 0.8%CVE-2022-3341MEDIUMA null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs bEPSS 0.8%CVE-2022-1035LOWSegmentation Fault caused by MP4Box -lsr in gpac/gpacEPSS 0.8%CVE-2023-52696HIGHpowerpc/powernv: Add a null pointer check in opal_powercap_init()EPSS 0.8%CVE-2022-31077MEDIUMMalicious response from KubeEdge can crash CSI Driver controller serverEPSS 0.8%CVE-2024-36620MEDIUMmoby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.EPSS 0.8%CVE-2024-43559MEDIUMWindows Mobile Broadband Driver Denial of Service VulnerabilityEPSS 0.8%CVE-2022-23525MEDIUMHelm vulnerable to Denial of service via NULL Pointer DereferenceEPSS 0.8%CVE-2022-23526MEDIUMHelm contains Denial of service through schema fileEPSS 0.8%