Falhas do tipo CWE-754

507 resultados

Falta de validação de condições excepcionais

A fraqueza ocorre quando o software não valida ou valida incorretamente situações anômalas que raramente acontecem durante a operação normal. O desenvolvedor assume que certas condições 'nunca vão acontecer', deixando o código vulnerável quando elas de fato ocorrem — seja por entrada malformada, estado corrompido ou cenários edge case não previstos.

Exemplo

Um parser JSON que só testa o caminho feliz: carrega e processa um JSON válido, mas quando recebe um arquivo com caracteres especiais, tamanho excepcional ou estrutura quebrada, falha silenciosamente ou causa comportamento indefinido em vez de rejeitar explicitamente o entrada inválida.

Como mitigar

Sempre validar entradas e estados, não presumir cenários 'impossíveis': use try-catch, verificações de limites, e testes que explorem casos anormais (fuzzing, boundary testing). Falhe de forma segura e explícita — nunca em silêncio.

CVE-2026-55484HIGHALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire serverEPSS 0.5%CVE-2024-24567MEDIUMraw_call `value=` kwargs not disabled for static and delegate callsEPSS 0.5%CVE-2026-87012MEDIUMOpen WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert valueEPSS 0.5%CVE-2022-22218HIGHJunos OS: SRX Series: Upon processing of a genuine packet the pkid process will crash during CMPv2 auto-re-enrollmentEPSS 0.5%CVE-2024-52504HIGHA vulnerability has been identified in SIPROTEC 4 6MD61 (All versions), SIPROTEC 4 6MD63 (All versions), SIPROTEC 4 6MD66 (All versions), SIEPSS 0.5%CVE-2026-4709HIGHIncorrect boundary conditions in the Audio/Video: GMP componentEPSS 0.5%CVE-2024-30409MEDIUMJunos OS and Junos OS Evolved: Higher CPU consumption on routing engine leads to Denial of Service (DoS).EPSS 0.5%CVE-2024-39530HIGHJunos OS: Attempting to access specific sensors on platforms not supporting these will lead to a chassisd crashEPSS 0.5%CVE-2024-1556MEDIUMThe incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and undefined behavior. *NoEPSS 0.5%CVE-2025-32997MEDIUMIn http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.EPSS 0.5%CVE-2025-23197MEDIUMmatrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub supportEPSS 0.5%CVE-2026-4706HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.5%CVE-2023-30456MEDIUMAn issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CEPSS 0.5%CVE-2026-8091CRITICALIncorrect boundary conditions in the Audio/Video: Playback componentEPSS 0.5%CVE-2024-11599HIGHDomain Restriction Bypass on RegistrationEPSS 0.5%CVE-2025-60011MEDIUMJunos OS and Junos OS Evolved: Optional transitive BGP attribute is modified before propagation to peers causing sessions to flapEPSS 0.5%CVE-2026-65838HIGHSkipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstreamEPSS 0.5%CVE-2025-69250MEDIUMfree5GC has Improper Error Handling in UDM, Leading to Information ExposureEPSS 0.5%CVE-2024-39832MEDIUMPermanently local data deletion by malicious remoteEPSS 0.5%CVE-2026-4708HIGHIncorrect boundary conditions in the Graphics componentEPSS 0.4%