Weaknesses of type CWE-253

23 results

Verificação incorreta do valor de retorno de função

Ocorre quando o código chama uma função mas não valida corretamente o seu retorno antes de usar o resultado. Isso deixa o programa operar com dados inválidos, nulos ou indicadores de erro, causando comportamentos impredizíveis, crashes ou brechas de segurança.

Example

Um código abre um arquivo com fopen() mas ignora ou verifica mal se o retorno é NULL, depois tenta ler dele — resultado é crash ou leitura de lixo de memória. Outro caso: função retorna um código de erro (0 = sucesso, -1 = falha), mas a aplicação segue adiante sem checar.

How to mitigate

Sempre validar o retorno de funções críticas (I/O, alocação de memória, operações criptográficas) antes de usar. Use assertions, comparações explícitas com valores esperados e trate erros de forma clara — não ignore retornos só porque 'normalmente funciona'.

CVE-2023-49286HIGHDenial of Service in Helper Process managementEPSS 10.4%CVE-2017-7474—It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypassEPSS 2.5%CVE-2024-43521HIGHWindows Hyper-V Denial of Service VulnerabilityEPSS 2.4%CVE-2020-6107MEDIUMAn exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted fEPSS 1.5%CVE-2022-24880MEDIUMPotential Captcha Validate Bypass in flask-session-captchaEPSS 1.2%CVE-2023-24487MEDIUMArbitrary file readEPSS 1.1%CVE-2024-1622HIGHRoutinator terminates when RTR connection is reset too quickly after openingEPSS 1.0%CVE-2023-34449MEDIUMink! vulnerable to incorrect decoding of storage value when using `DelegateCall`EPSS 1.0%CVE-2021-37625HIGHIncorrect Check of Function Return Value in SkytableEPSS 0.9%CVE-2026-35091HIGHCorosync: corosync: denial of service and information disclosure via crafted udp packetEPSS 0.9%CVE-2023-52040HIGHAn issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.EPSS 0.9%CVE-2025-54090MEDIUMApache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64EPSS 0.7%CVE-2024-32475HIGHEnvoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytesEPSS 0.7%CVE-2023-4501CRITICALAuthentication bypass in OpenText (Micro Focus) Enterprise ServerEPSS 0.6%CVE-2025-57767HIGHAsterisk can crash from a specifically malformed Authorization header in an incoming SIP requestEPSS 0.4%CVE-2026-46419HIGHYubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor EPSS 0.3%CVE-2025-11839MEDIUMGNU Binutils prdbg.c tg_tag_type return valueEPSS 0.3%CVE-2026-43863LOWmutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.EPSS 0.2%CVE-2026-5818HIGHMCU Firmware Update Authentication Bypass on Caliptra CoreEPSS 0.2%CVE-2026-35339MEDIUMuutils coreutils chmod False Success Exit Code in Recursive ModeEPSS 0.1%