Falhas do tipo CWE-703

174 resultados

Tratamento inadequado de condições excepcionais

O código não verifica ou trata corretamente situações de erro e exceções, permitindo que o programa continue com um estado inválido ou imprevisível. Isso pode levar a comportamentos inesperados, falhas de segurança ou exposição de informações sensíveis quando algo sai do planejado.

Exemplo

Uma aplicação web tenta conectar a um banco de dados remoto, mas se a conexão falhar, o código não trata a exceção e continua executando, usando uma variável de conexão nula. O resultado é um crash que revela detalhes da infraestrutura ao usuário, ou a execução de lógica com dados corrompidos.

Como mitigar

Sempre use try-catch ou mecanismos equivalentes para capturar exceções. Implemente uma estratégia de tratamento explícito: log do erro (sem expor detalhes sensíveis), rollback de operações incompletas e retorno de uma resposta segura ao usuário. Faça testes com cenários de falha.

CVE-2020-1639HIGHJunos OS: A crafted Ethernet OAM packet received by Junos may cause the Ethernet OAM connectivity fault management process (CFM) to core.EPSS 1.1%CVE-2021-0286HIGHJunos OS Evolved: Specially crafted packets may cause the AFT manager process to crash and restartEPSS 1.1%CVE-2025-43430MEDIUMThis issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, EPSS 1.0%CVE-2023-29195MEDIUMVitess VTAdmin users that can create shards can deny access to other functionsEPSS 1.0%CVE-2021-0264MEDIUMJunos OS and Junos OS Evolved: MX Series with MPC10/MPC11, PTX10003, PTX10008: Line card may crash and restart when traffic is hitting a firewall filter having a term with syslog action configuredEPSS 1.0%CVE-2021-23859CRITICALDenial of Service and Authentication Bypass Vulnerability in multiple Bosch productsEPSS 1.0%CVE-2021-25370MEDIUMAn incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kEPSS 0.9%KEVCVE-2025-46290HIGHA logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS SequoEPSS 0.9%CVE-2025-43240MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 18.6, macOS Sequoia 15.6. A download's origin may be incorreEPSS 0.9%CVE-2023-45927CRITICALS-Lang 2.3.2 was discovered to contain an arithmetic exception via the function tt_sprintf().EPSS 0.8%CVE-2022-20924HIGHA vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco FirepEPSS 0.8%CVE-2021-25372MEDIUMAn improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.EPSS 0.8%KEVCVE-2021-25425—Improper check vulnerability in Samsung Health prior to version 6.17 allows attacker to read internal cache data via exported component.EPSS 0.8%CVE-2022-22290MEDIUMIncorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted HEPSS 0.8%CVE-2023-29194MEDIUMvitess allows users to create keyspaces that can deny access to already existing keyspacesEPSS 0.8%CVE-2024-39815CRITICALVonets WiFi Bridges Improper Check or Handling of Exceptional ConditionsEPSS 0.8%CVE-2021-25419—Non-compliance of recommended secure coding scheme in Samsung Internet prior to version 14.0.1.62 allows attackers to display fake URL in adEPSS 0.8%CVE-2023-32230HIGHAn improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthenticated attacker to causEPSS 0.7%CVE-2023-41378HIGHCalico Typha hangs during unclean TLS handshakeEPSS 0.7%CVE-2022-23003MEDIUMShared secret or Point multiplication of NIST P-256 points with X coordinate of zeroEPSS 0.7%