Weaknesses of type CWE-476

2,177 results

Desreferência de nulo autenticada remota

A aplicação não valida corretamente se um ponteiro ou referência é nulo antes de usá-lo, permitindo que um usuário autenticado remotamente forneça entrada que causa uma desreferência de nulo. O resultado é um crash da aplicação ou, em cenários mais graves, execução de código não prevista, dependendo de como a memória é tratada.

Example

Um endpoint de API autenticada que busca um usuário por ID, mas não verifica se o resultado da busca é nulo. Um atacante autenticado fornece um ID inexistente, o código tenta acessar propriedades do resultado nulo e a aplicação falha ou se comporta de forma imprevista.

How to mitigate

Sempre validar retornos de funções que podem ser nulos antes de acessar seus membros ou métodos. Use assertions, verificações explícitas (if obj != null) ou mecanismos de linguagem como optional/Maybe types para forçar o tratamento seguro de valores nulos.

CVE-2023-21758HIGHWindows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityEPSS 92.5%CVE-2023-21547HIGHInternet Key Exchange (IKE) Protocol Denial of Service VulnerabilityEPSS 89.3%CVE-2021-44224—Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlierEPSS 82.3%CVE-2023-38171HIGHMicrosoft QUIC Denial of Service VulnerabilityEPSS 69.5%CVE-2021-34798—NULL pointer dereference in httpd coreEPSS 64.5%CVE-2025-21285HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 54.8%CVE-2022-44793MEDIUMhandle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be uEPSS 53.5%CVE-2022-44792MEDIUMhandle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used byEPSS 52.1%CVE-2017-15120HIGHAn issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference wheEPSS 51.8%CVE-2021-31618—NULL pointer dereference on specially crafted HTTP/2 requestEPSS 51.5%CVE-2020-17525—Remote unauthenticated denial-of-service in Subversion mod_authz_svnEPSS 40.1%CVE-2019-3995—ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. A remote unauthenticated atEPSS 28.5%CVE-2024-37399HIGHA NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, reEPSS 27.8%CVE-2021-41524—null pointer dereference in h2 fuzzingEPSS 25.2%CVE-2019-5010MEDIUMAn exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafteEPSS 21.4%CVE-2011-1271HIGHThe JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handlEPSS 20.1%CVE-2017-3169—In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_prEPSS 20.0%CVE-2016-10708HIGHsshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-seEPSS 15.7%CVE-2021-34586HIGHCODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)EPSS 13.1%CVE-2025-1103HIGHD-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereferenceEPSS 13.0%