Fallos del tipo CWE-252

101 resultados

Valor de retorno não verificado

Quando o código chama uma função mas não verifica se ela foi bem-sucedida (ignorando o valor de retorno), assume incorretamente que a operação funcionou. Isso deixa o programa em estado inconsistente e pode levar a falhas de segurança ou corrupção de dados.

Ejemplo

Um desenvolvedor abre um arquivo com `fopen()` mas não verifica se retornou NULL antes de usar o ponteiro. Se o arquivo não existir, o ponteiro inválido causará crash ou comportamento impredizível. Outro caso comum: chamar `chmod()` para mudar permissões sem verificar se falhou, deixando o arquivo com permissões erradas.

Cómo mitigar

Sempre verifique o retorno de funções críticas (I/O, alocação de memória, operações de sistema). Use análise estática para detectar returns ignorados. Em C, trate explicitamente erros com `if`, `goto` ou padrões como `defer`; em linguagens modernas, use exceções ou tipos `Result/Optional`.

CVE-2007-3798CRITICALInteger overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafEPSS 70.4%CVE-2018-14622MEDIUMA null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked iEPSS 3.9%CVE-2020-17533—Apache Accumulo Improper Handling of Insufficient PermissionsEPSS 3.7%CVE-2002-1372HIGHCommon Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, whEPSS 3.0%CVE-2021-4189MEDIUMA flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTPEPSS 2.7%CVE-2024-35235MEDIUMCupsd Listen arbitrary chmod 0140777EPSS 2.4%CVE-2021-42780—A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the liEPSS 2.1%CVE-2020-6152CRITICALA code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A specially crafted malfoEPSS 1.9%CVE-2022-23476HIGHUnchecked return value from xmlTextReaderExpand in NokogiriEPSS 1.7%CVE-2024-50306CRITICALApache Traffic Server: Server process can fail to drop privilegeEPSS 1.6%CVE-2023-6918LOWLibssh: missing checks for return values for digestsEPSS 1.4%CVE-2021-40401CRITICALA use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd)EPSS 1.3%CVE-2024-0743HIGHAn unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122,EPSS 1.3%CVE-2022-1319—A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flEPSS 1.3%CVE-2022-31089HIGHInvalid file request can crashe parse-serverEPSS 1.1%CVE-2021-41041—In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is EPSS 1.0%CVE-2023-24825HIGHRIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_markEPSS 1.0%CVE-2021-37625HIGHIncorrect Check of Function Return Value in SkytableEPSS 0.9%CVE-2021-34585HIGHCODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)EPSS 0.9%CVE-2022-40716MEDIUMHashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPEPSS 0.9%