Falhas do tipo CWE-755

243 resultados

Tratamento inadequado de condições excepcionais

É quando o código não trata, trata de forma insuficiente ou de forma errada situações de erro e exceções. Isso pode deixar o software em estado inconsistente, ignorar falhas críticas ou executar código perigoso quando algo dá errado, compromentendo segurança, integridade ou disponibilidade.

Exemplo

Um servidor Web recebe uma requisição mal formada e falha ao parsear JSON; em vez de retornar erro 400, simplesmente pula a validação e processa dados vazios, ou uma conexão de banco de dados cai e a aplicação continua operando com dados em cache desatualizado sem avisar o usuário.

Como mitigar

Sempre trate exceções explicitamente: capture erros conhecidos e faça rollback/limpeza apropriada, log de falhas para auditoria, e retorne respostas claras ao usuário. Use type hints e validação de entrada antes de processar, e considere parar o sistema de forma segura se a exceção for crítica.

CVE-2021-42145HIGHAn assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cEPSS 0.4%CVE-2026-89025HIGHHirschmann HiOS Switch Platform DoS via Malformed HTTP RequestEPSS 0.4%CVE-2026-53459CRITICALBambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpointsEPSS 0.4%CVE-2025-66622LOWmatrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event valuesEPSS 0.4%CVE-2026-27809MEDIUMpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gapsEPSS 0.4%CVE-2024-53984MEDIUMNanopb does not release memory on error return when using PB_DECODE_DELIMITEDEPSS 0.4%CVE-2026-25957MEDIUMCube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted requestEPSS 0.4%CVE-2026-44319HIGHfree5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)EPSS 0.4%CVE-2025-62711LOWWasmtime vulnerable to segfault when using component resourcesEPSS 0.4%CVE-2024-36112MEDIUMNautobot dynamic-group-members doesn't enforce permission restrictions on member objectsEPSS 0.4%CVE-2026-44325HIGHfree5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)EPSS 0.4%CVE-2023-25561MEDIUMLogin fail open on JAAS misconfiguration in DataHubEPSS 0.4%CVE-2024-11863MEDIUMSCP-Firmware VulnerabilityEPSS 0.4%CVE-2023-1695—Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause featEPSS 0.4%CVE-2023-1732MEDIUMImproper random reading in CIRCLEPSS 0.4%CVE-2026-59162MEDIUMExcelize: Negative shared-string index causes panic in GetCellValue and GetRowsEPSS 0.4%CVE-2021-0259HIGHJunos OS and Junos OS Evolved: QFX5K Series: Underlay network traffic might not be processed upon receipt of high rate of specific genuine overlay packets in VXLAN scenarioEPSS 0.4%CVE-2021-0290MEDIUMJunos OS: MX Series, EX9200 Series, SRX4600: Ethernet interface vulnerable to specially crafted framesEPSS 0.4%CVE-2024-9413HIGHThe transport_message_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing EPSS 0.4%CVE-2026-34065HIGHnimiq-primitives: Node crash due to missing interlink validation in election macro block proposalsEPSS 0.4%