Falhas do tipo CWE-703

174 resultados

Tratamento inadequado de condições excepcionais

O código não verifica ou trata corretamente situações de erro e exceções, permitindo que o programa continue com um estado inválido ou imprevisível. Isso pode levar a comportamentos inesperados, falhas de segurança ou exposição de informações sensíveis quando algo sai do planejado.

Exemplo

Uma aplicação web tenta conectar a um banco de dados remoto, mas se a conexão falhar, o código não trata a exceção e continua executando, usando uma variável de conexão nula. O resultado é um crash que revela detalhes da infraestrutura ao usuário, ou a execução de lógica com dados corrompidos.

Como mitigar

Sempre use try-catch ou mecanismos equivalentes para capturar exceções. Implemente uma estratégia de tratamento explícito: log do erro (sem expor detalhes sensíveis), rollback de operações incompletas e retorno de uma resposta segura ao usuário. Faça testes com cenários de falha.

CVE-2022-23004MEDIUMAlgorithm incorrectly returning error and Invalid unreduced value written to output bufferEPSS 0.7%CVE-2022-23002MEDIUMPoint Compression/Decompression of NIST P-256 points with X coordinate of zeroEPSS 0.7%CVE-2025-70758HIGHchetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/auth_validate.php. The apEPSS 0.7%CVE-2026-21720HIGHUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outEPSS 0.7%CVE-2023-22413HIGHJunos OS: MX Series: The Multiservices PIC Management Daemon (mspmand) will crash when an IPsec6 tunnel processes specific IPv4 packetsEPSS 0.6%CVE-2021-23261MEDIUMOverriding the system configuration file causes a denial of serviceEPSS 0.6%CVE-2026-32641HIGHParseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middlewareEPSS 0.6%CVE-2023-36831HIGHJunos OS: SRX Series: jbuf memory leak when SSL Proxy and UTM Web-Filtering is appliedEPSS 0.6%CVE-2023-28965MEDIUMJunos OS: QFX10002: Failure of storm control feature may lead to Denial of ServiceEPSS 0.6%CVE-2026-44893HIGHNetty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthEPSS 0.6%CVE-2021-3329CRITICALDOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layerEPSS 0.6%CVE-2019-11245MEDIUMkubelet-started container uid changes to root after first restart or if image is already pulled to the nodeEPSS 0.6%CVE-2021-25380MEDIUMImproper handling of exceptional conditions in Bixby prior to version 3.0.53.02 allows attacker to execute the actions registered by the useEPSS 0.6%CVE-2024-31883MEDIUMIBM Security Verify Access denial of serviceEPSS 0.6%CVE-2025-59531HIGHUnauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payloadEPSS 0.6%CVE-2024-27832CRITICALThe issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, wEPSS 0.6%CVE-2025-59836MEDIUMOmni is Vulnerable to DoS via Empty Create/Update Resource RequestsEPSS 0.6%CVE-2022-34472MEDIUMIf there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrecEPSS 0.6%CVE-2025-24188MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 18.6, macOS Sequoia 15.6. Processing maliciously crafted webEPSS 0.6%CVE-2024-21629MEDIUMErroneous handling of `record_external_operation` error returnEPSS 0.6%