Falhas do tipo CWE-755

243 resultados

Tratamento inadequado de condições excepcionais

É quando o código não trata, trata de forma insuficiente ou de forma errada situações de erro e exceções. Isso pode deixar o software em estado inconsistente, ignorar falhas críticas ou executar código perigoso quando algo dá errado, compromentendo segurança, integridade ou disponibilidade.

Exemplo

Um servidor Web recebe uma requisição mal formada e falha ao parsear JSON; em vez de retornar erro 400, simplesmente pula a validação e processa dados vazios, ou uma conexão de banco de dados cai e a aplicação continua operando com dados em cache desatualizado sem avisar o usuário.

Como mitigar

Sempre trate exceções explicitamente: capture erros conhecidos e faça rollback/limpeza apropriada, log de falhas para auditoria, e retorne respostas claras ao usuário. Use type hints e validação de entrada antes de processar, e considere parar o sistema de forma segura se a exceção for crítica.

CVE-2024-32652HIGH@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsedEPSS 0.9%CVE-2021-4105CRITICALUnauthenticated Remote Code Execution on COSLAT FirewallEPSS 0.9%CVE-2022-20920HIGHCisco IOS and IOS XE Software SSH Denial of Service VulnerabilityEPSS 0.9%CVE-2023-40184LOWImproper handling of session establishment errors in xrdpEPSS 0.9%CVE-2023-46673MEDIUMIt was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when EPSS 0.8%CVE-2021-21592LOWDell EMC PowerScale OneFS versions 8.2.x - 9.2.x improperly handle an exceptional condition. A remote low privileged user could potentially EPSS 0.8%CVE-2022-46403HIGHThe Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages.EPSS 0.8%CVE-2022-29617—Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the applicationEPSS 0.8%CVE-2022-47933MEDIUMBrave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme.EPSS 0.8%CVE-2022-32264HIGHsys/netinet/tcp_timer.h in FreeBSD before 7.0 contains a denial-of-service (DoS) vulnerability due to improper handling of TSopt on TCP connEPSS 0.8%CVE-2023-41317HIGHUnnamed "Subscription" operation results in Denial-of-Service in apollographql/routerEPSS 0.8%CVE-2021-43827MEDIUMInline footnotes wrapped in <a> tags can cause errors in discourse-footnotesEPSS 0.8%CVE-2024-3150HIGHPrivilege Escalation in mintplex-labs/anything-llmEPSS 0.8%CVE-2025-34193HIGHVasion Print (formerly PrinterLogic) Insecure Windows Components Lack Modern Memory Protections and Use Outdated RuntimesEPSS 0.8%CVE-2022-23496HIGHA crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa EPSS 0.8%CVE-2024-23325HIGHEnvoy crashes when using an address type that isn’t supported by the OSEPSS 0.8%CVE-2024-8376HIGHMemory leakEPSS 0.7%CVE-2024-20699MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 0.7%CVE-2023-27595MEDIUMCilium eBPF filters may be temporarily removed during agent restartEPSS 0.7%CVE-2021-0297MEDIUMJunos OS Evolved: BGP and LDP sessions with TCP MD5 authentication established with peers not configured for authenticationEPSS 0.7%