Weaknesses of type CWE-755

232 results

Tratamento inadequado de condições excepcionais

Ocorre quando o código falha em capturar, validar ou responder adequadamente a erros e situações anormais. O programa continua executando com estado inválido, ignorando sinais de falha do sistema ou bibliotecas, permitindo que bugs se propaguem e criem vulnerabilidades de segurança.

Example

Uma aplicação tenta abrir um arquivo sem verificar se a operação falhou; se o arquivo não existe, a variável fica nula, e acessá-la depois causa crash ou comportamento impredizível. Ou um banco de dados retorna erro, mas o código ignora e usa dados vazios como válidos.

How to mitigate

Sempre capture exceções e erros explicitamente — use try/catch, verifique códigos de retorno e valores nulos antes de usar. Registre falhas em logs, falhe de forma segura (recuse a operação) e nunca assuma que uma chamada de função funcionou sem comprovação.

CVE-2017-5638CRITICALThe Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mesEPSS 100.0%KEVCVE-2020-7247CRITICALsmtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary coEPSS 98.9%KEVCVE-2021-28165HIGHIn Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invaEPSS 53.9%CVE-2021-38003HIGHInappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption vEPSS 38.6%KEVCVE-2019-6848—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication modEPSS 33.0%CVE-2024-21907HIGHImproper Handling of Exceptional Conditions in Newtonsoft.JsonEPSS 32.9%CVE-2019-6841—A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon EPSS 24.4%CVE-2025-43864HIGHReact Router allows a DoS via cache poisoning by forcing SPA modeEPSS 20.2%CVE-2022-23121CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required tEPSS 8.6%CVE-2023-5824HIGHSquid: dos against http and httpsEPSS 5.2%CVE-2019-10222HIGHA flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crashEPSS 4.6%CVE-2024-34750HIGHApache Tomcat: HTTP/2 excess header handling DoSEPSS 4.6%CVE-2021-28831HIGHdecompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or seEPSS 2.7%CVE-2021-34593HIGHCODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-serviceEPSS 2.6%CVE-2021-46828HIGHIn libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connectionEPSS 2.6%CVE-2020-15117MEDIUMDenial of Service in SynergyEPSS 2.5%CVE-2021-39157HIGHImproper Handling of Exceptional Conditions in detect-character-encodingEPSS 2.1%CVE-2021-25662HIGHA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 1.6%CVE-2022-21667HIGHDenial of Service in soketiEPSS 1.6%CVE-2020-15223HIGHIgnored storage errors on token revokation in ORY FositeEPSS 1.6%