Falhas do tipo CWE-755

243 resultados

Tratamento inadequado de condições excepcionais

É quando o código não trata, trata de forma insuficiente ou de forma errada situações de erro e exceções. Isso pode deixar o software em estado inconsistente, ignorar falhas críticas ou executar código perigoso quando algo dá errado, compromentendo segurança, integridade ou disponibilidade.

Exemplo

Um servidor Web recebe uma requisição mal formada e falha ao parsear JSON; em vez de retornar erro 400, simplesmente pula a validação e processa dados vazios, ou uma conexão de banco de dados cai e a aplicação continua operando com dados em cache desatualizado sem avisar o usuário.

Como mitigar

Sempre trate exceções explicitamente: capture erros conhecidos e faça rollback/limpeza apropriada, log de falhas para auditoria, e retorne respostas claras ao usuário. Use type hints e validação de entrada antes de processar, e considere parar o sistema de forma segura se a exceção for crítica.

CVE-2022-1965HIGHCODESYS runtime system prone to file deletion due to improper error handlingEPSS 1.1%CVE-2021-31361MEDIUMJunos OS: QFX Series and PTX Series: FPC resource usage increases when certain packets are processed which are being VXLAN encapsulatedEPSS 1.0%CVE-2024-28869HIGHPossible denial of service vulnerability with Content-length header in TraefikEPSS 1.0%CVE-2021-22285HIGHSECURITY – Denial of Service Vulnerabilities in SPIET800 INFI-Net to Ethernet Transfer module and PNI800 S+ Ethernet communication interface moduleEPSS 1.0%CVE-2022-3279LOWAn unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15EPSS 1.0%CVE-2021-0299HIGHJunos OS: Kernel crash (vmcore) upon receipt of a malformed IPv6 packetEPSS 1.0%CVE-2021-3053HIGHPAN-OS: Exceptional Condition Denial-of-Service (DoS)EPSS 1.0%CVE-2022-23161HIGHDell PowerScale OneFS versions 8.2.x - 9.3.0.x contain a denial-of-service vulnerability in SmartConnect. An unprivileged network attacker mEPSS 1.0%CVE-2024-39547HIGHJunos OS and Junos OS Evolved: cRPD: Receipt of crafted TCP traffic can trigger high CPU utilizationEPSS 1.0%CVE-2021-32999HIGHAVEVA SuiteLink Server Improper Handling of Exceptional ConditionsEPSS 1.0%CVE-2019-6843—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon EPSS 1.0%CVE-2019-6847—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modulesEPSS 1.0%CVE-2019-6844—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modulesEPSS 1.0%CVE-2019-6842—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modulesEPSS 1.0%CVE-2022-22177MEDIUMJunos OS and Junos OS Evolved: After receiving a specific number of crafted packets snmpd will segmentation fault (SIGSEGV) requiring a manual restart.EPSS 1.0%CVE-2022-36031MEDIUMUnhandled exception on illegal filename_disk valueEPSS 0.9%CVE-2022-48329CRITICALMISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/MEPSS 0.9%CVE-2021-3063HIGHPAN-OS: Denial-of-Service (DoS) Vulnerability in GlobalProtect Portal and Gateway InterfacesEPSS 0.9%CVE-2022-22174HIGHJunos OS: QFX5000 Series, EX4600: Device may run out of memory, causing traffic loss, upon receipt of specific IPv6 packetsEPSS 0.9%CVE-2022-23018—On BIG-IP AFM version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and 13.1.x beginning in 13.1.3.4, when a virtualEPSS 0.9%