Falhas do tipo CWE-754

461 resultados

Falta de validação de condições excepcionais

A fraqueza ocorre quando o software não valida ou valida incorretamente situações anômalas que raramente acontecem durante a operação normal. O desenvolvedor assume que certas condições 'nunca vão acontecer', deixando o código vulnerável quando elas de fato ocorrem — seja por entrada malformada, estado corrompido ou cenários edge case não previstos.

Exemplo

Um parser JSON que só testa o caminho feliz: carrega e processa um JSON válido, mas quando recebe um arquivo com caracteres especiais, tamanho excepcional ou estrutura quebrada, falha silenciosamente ou causa comportamento indefinido em vez de rejeitar explicitamente o entrada inválida.

Como mitigar

Sempre validar entradas e estados, não presumir cenários 'impossíveis': use try-catch, verificações de limites, e testes que explorem casos anormais (fuzzing, boundary testing). Falhe de forma segura e explícita — nunca em silêncio.

CVE-2023-52710HIGHHuawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26), As the communication buffer size hasn’t been properly validated to be of the expected siEPSS 0.1%CVE-2026-30900HIGHZoom Workplace Clients for Windows - Improper CheckEPSS 0.1%CVE-2022-20588MEDIUMIn sysmmu_map of sysmmu.c, there is a possible EoP due to a precondition check failure. This could lead to local escalation of privilege witEPSS 0.1%CVE-2026-22760LOWDell Device Management Agent (DDMA), versions prior to 26.02, contain an Improper Check for Unusual or Exceptional Conditions vulnerability.EPSS 0.1%CVE-2026-11970MEDIUMThis vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E EPSS 0.1%CVE-2026-59112MEDIUMSignature validation vulnerability affecting DigiDoc applicationsEPSS 0.1%CVE-2025-32088MEDIUMImproper conditions check for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow a denial oEPSS 0.1%CVE-2026-20486MEDIUMIn imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a mEPSS 0.1%CVE-2026-18852MEDIUMepsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual conditionEPSS 0.1%CVE-2026-0235MEDIUMPrisma Browser: Access and Data Rule BypassEPSS 0.1%CVE-2026-20783MEDIUMImproper conditions check in the firmware for the Intel(R) NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of sEPSS 0.1%CVE-2026-20754MEDIUMImproper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service. UnprivEPSS 0.1%CVE-2025-32735MEDIUMImproper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service. UnprivEPSS 0.1%CVE-2025-20070MEDIUMImproper conditions check for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_02.00.00.4052, CR_MGMT_03.00.00.0538 EPSS 0.1%CVE-2021-25481MEDIUMAn improper error handling in Exynos CP booting driver prior to SMR Oct-2021 Release 1 allows local attackers to bypass a Secure Memory ProtEPSS 0.1%CVE-2026-33786MEDIUMJunos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashesEPSS 0.1%CVE-2022-20426MEDIUMIn multiple functions of many files, there is a possible obstruction of the user's ability to select a phone account due to resource exhaustEPSS 0.1%CVE-2026-33787MEDIUMJunos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specific show command is executed chassisd crashesEPSS 0.1%CVE-2024-20037MEDIUMIn pq, there is a possible write-what-where condition due to an incorrect bounds check. This could lead to local escalation of privilege witEPSS 0.1%CVE-2025-35992MEDIUMImproper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service. UnprivEPSS 0.1%