Falhas do tipo CWE-476

2.571 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2022-35691MEDIUMAdobe Acrobat Reader NULL Pointer Dereference Application denial-of-serviceEPSS 4.4%CVE-2017-7502—Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of servEPSS 4.3%CVE-2020-9746HIGHExploitable NULL pointer deref could lead to arbitrary code executionEPSS 4.3%CVE-2023-32248HIGHTree connection null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2023-32252HIGHSession null pointer dereference denial-of-service vulnerabilityEPSS 4.1%CVE-2018-14404MEDIUMA NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invaliEPSS 3.7%CVE-2021-38604HIGHIn librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading EPSS 3.7%CVE-2014-0757—Smart Software Solutions (3S) CoDeSys Runtime Toolkit NULL Pointer DereferenceEPSS 3.6%CVE-2021-44740LOWAdobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-serviceEPSS 3.6%CVE-2021-44741LOWAdobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-serviceEPSS 3.6%CVE-2021-3537—A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing aEPSS 3.6%CVE-2018-18066HIGHsnmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attackEPSS 3.6%CVE-2020-7062HIGHNull Pointer Dereference in PHP Session Upload ProgressEPSS 3.6%CVE-2020-8859MEDIUMThis vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.EPSS 3.6%CVE-2024-47586MEDIUMNULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP PlatformEPSS 3.5%CVE-2020-5762—Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service. An unauEPSS 3.4%CVE-2018-16851MEDIUMSamba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP seaEPSS 3.3%CVE-2004-0458HIGHmah-jong before 1.6.2 allows remote attackers to cause a denial of service (server crash) via a missing argument, which triggers a null poinEPSS 3.2%CVE-2020-3481HIGHClam AntiVirus (ClamAV) Software Null Pointer Dereference VulnerabilityEPSS 3.2%CVE-2017-9631—A Null Pointer Dereference issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. The nEPSS 3.2%