Weaknesses of type CWE-248

243 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2025-59538HIGHArgo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookEPSS 8.3%CVE-2021-37714HIGHCrafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptionsEPSS 6.9%CVE-2025-53366HIGHMCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of ServiceEPSS 6.0%CVE-2018-11466—A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versEPSS 4.0%CVE-2025-59465HIGHA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` erEPSS 3.6%CVE-2018-7852HIGHA CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium wEPSS 3.6%CVE-2020-6019—Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBaEPSS 2.8%CVE-2020-10604—In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through speciEPSS 2.1%CVE-2022-41940HIGHUncaught exception in engine.io EPSS 1.9%CVE-2018-11464—A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HFEPSS 1.9%CVE-2019-6809—A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions priorEPSS 1.8%CVE-2019-6575HIGHA vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUSEPSS 1.6%CVE-2022-24822HIGHDenial of Service in @podium/layout and @podium/proxyEPSS 1.6%CVE-2019-6829HIGHA CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prioEPSS 1.6%CVE-2020-15796—A vulnerability has been identified in SIMATIC ET 200SP Open Controller (incl. SIPLUS variants) (V20.8), SIMATIC S7-1500 Software ControllerEPSS 1.6%CVE-2019-6828—A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to VEPSS 1.5%CVE-2019-10931—A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet commuEPSS 1.5%CVE-2020-10292HIGHService DoS through arbitrary pointer dereferencing on KUKA simulatorEPSS 1.5%CVE-2022-31015MEDIUMUncaught Exception (due to a data race) leads to process termination in WaitressEPSS 1.4%CVE-2025-3891HIGHMod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabledEPSS 1.4%