Falhas do tipo CWE-703

154 resultados

Tratamento inadequado de condições excepcionais

O código não verifica ou trata corretamente situações de erro e exceções, permitindo que o programa continue com um estado inválido ou imprevisível. Isso pode levar a comportamentos inesperados, falhas de segurança ou exposição de informações sensíveis quando algo sai do planejado.

Exemplo

Uma aplicação web tenta conectar a um banco de dados remoto, mas se a conexão falhar, o código não trata a exceção e continua executando, usando uma variável de conexão nula. O resultado é um crash que revela detalhes da infraestrutura ao usuário, ou a execução de lógica com dados corrompidos.

Como mitigar

Sempre use try-catch ou mecanismos equivalentes para capturar exceções. Implemente uma estratégia de tratamento explícito: log do erro (sem expor detalhes sensíveis), rollback de operações incompletas e retorno de uma resposta segura ao usuário. Faça testes com cenários de falha.

CVE-2024-21894HIGHA heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malEPSS 19.0%CVE-2025-59538HIGHArgo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookEPSS 8.3%CVE-2019-5031HIGHAn exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. A EPSS 6.0%CVE-2023-49786HIGHAsterisk susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 5.3%CVE-2024-10781HIGHSpam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin InstallationEPSS 3.8%CVE-2024-22052HIGHA null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenEPSS 3.8%CVE-2024-22053HIGHA heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malEPSS 3.5%CVE-2024-22023MEDIUMAn XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unautEPSS 3.0%CVE-2017-16014—Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crashEPSS 1.7%CVE-2024-29205HIGHAn Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti PEPSS 1.6%CVE-2022-25252HIGHPTC Axeda agent and Axeda Desktop Server Improper Check or Handling Of Exceptional ConditionsEPSS 1.6%CVE-2023-51443HIGHFreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 1.5%CVE-2022-41777HIGHImproper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlEPSS 1.5%CVE-2018-12551—When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the pEPSS 1.5%CVE-2020-2075—Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LEPSS 1.4%CVE-2020-1644HIGHJunos OS and Junos OS Evolved: RPD crash due to specific BGP UPDATE packetsEPSS 1.3%CVE-2019-10927—A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCAEPSS 1.2%CVE-2024-26007MEDIUMAn improper check or handling of exceptional conditions vulnerability [CWE-703] in Fortinet FortiOS version 7.4.1 allows an unauthenticated EPSS 1.2%CVE-2023-0004MEDIUMPAN-OS: Local File Deletion VulnerabilityEPSS 1.1%CVE-2020-1639HIGHJunos OS: A crafted Ethernet OAM packet received by Junos may cause the Ethernet OAM connectivity fault management process (CFM) to core.EPSS 1.1%