Falhas do tipo CWE-755

232 resultados

Tratamento inadequado de condições excepcionais

É quando o código não trata, trata de forma insuficiente ou de forma errada situações de erro e exceções. Isso pode deixar o software em estado inconsistente, ignorar falhas críticas ou executar código perigoso quando algo dá errado, compromentendo segurança, integridade ou disponibilidade.

Exemplo

Um servidor Web recebe uma requisição mal formada e falha ao parsear JSON; em vez de retornar erro 400, simplesmente pula a validação e processa dados vazios, ou uma conexão de banco de dados cai e a aplicação continua operando com dados em cache desatualizado sem avisar o usuário.

Como mitigar

Sempre trate exceções explicitamente: capture erros conhecidos e faça rollback/limpeza apropriada, log de falhas para auditoria, e retorne respostas claras ao usuário. Use type hints e validação de entrada antes de processar, e considere parar o sistema de forma segura se a exceção for crítica.

CVE-2017-5638CRITICALThe Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mesEPSS 100.0%KEVCVE-2020-7247CRITICALsmtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary coEPSS 98.9%KEVCVE-2021-28165HIGHIn Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invaEPSS 53.9%CVE-2021-38003HIGHInappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption vEPSS 38.6%KEVCVE-2019-6848—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication modEPSS 33.0%CVE-2024-21907HIGHImproper Handling of Exceptional Conditions in Newtonsoft.JsonEPSS 32.9%CVE-2019-6841—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon EPSS 24.4%CVE-2025-43864HIGHReact Router allows a DoS via cache poisoning by forcing SPA modeEPSS 20.2%CVE-2022-23121CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required tEPSS 8.6%CVE-2023-5824HIGHSquid: dos against http and httpsEPSS 5.2%CVE-2019-10222HIGHA flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crashEPSS 4.6%CVE-2024-34750HIGHApache Tomcat: HTTP/2 excess header handling DoSEPSS 4.6%CVE-2021-28831HIGHdecompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or seEPSS 2.7%CVE-2021-34593HIGHCODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-serviceEPSS 2.6%CVE-2021-46828HIGHIn libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connectionEPSS 2.6%CVE-2020-15117MEDIUMDenial of Service in SynergyEPSS 2.5%CVE-2021-39157HIGHImproper Handling of Exceptional Conditions in detect-character-encodingEPSS 2.1%CVE-2021-25662HIGHA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 1.6%CVE-2022-21667HIGHDenial of Service in soketiEPSS 1.6%CVE-2020-15223HIGHIgnored storage errors on token revokation in ORY FositeEPSS 1.6%