Fallos del tipo CWE-391

24 resultados

Condição de erro não verificada

O código chama uma função ou operação sem verificar se ela falhou. Quando essa falha não é tratada, o programa continua executando com dados inválidos ou em estado inconsistente, podendo levar a comportamentos inesperados, corrupção de dados ou vulnerabilidades de segurança.

Ejemplo

Uma aplicação abre um arquivo de configuração sem validar se a abertura foi bem-sucedida. Se o arquivo não existir, a variável de configuração fica nula, mas o código tenta usá-la adiante, causando crash ou uso de valores padrão perigosos (como credenciais vazias).

Cómo mitigar

Sempre verifique o retorno de funções críticas (abertura de arquivos, alocação de memória, operações de rede) e implemente tratamento explícito de erros. Use padrões como try-catch, verificação de códigos de erro ou assertions para garantir que falhas sejam detectadas e tratadas antes de continuar a execução.

CVE-2024-52316CRITICALApache Tomcat: Authentication bypass when using Jakarta Authentication APIEPSS 6.3%CVE-2017-12177—xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X serEPSS 4.4%CVE-2017-12179—xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to EPSS 4.4%CVE-2017-12186—xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash oEPSS 4.3%CVE-2017-12181—xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash EPSS 4.2%CVE-2017-12183—xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or poEPSS 4.2%CVE-2017-12182—xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash EPSS 4.2%CVE-2017-12180—xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to craEPSS 4.2%CVE-2017-12184—xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or EPSS 4.2%CVE-2017-12185—xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to cEPSS 4.2%CVE-2017-12176—xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause XEPSS 4.2%CVE-2017-12178—xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server tEPSS 4.2%CVE-2017-12187—xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or poEPSS 3.3%CVE-2019-14853LOWAn error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexEPSS 2.5%CVE-2020-14383—A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also seEPSS 2.2%CVE-2016-10526—A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth pEPSS 1.6%CVE-2023-0572MEDIUMUnchecked Error Condition in froxlor/froxlorEPSS 0.7%CVE-2025-71325CRITICALpicklescan - Detection Bypass via STACK_GLOBAL Opcode Parsing Logic FlawEPSS 0.5%CVE-2018-1091—In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggeEPSS 0.4%CVE-2022-22160MEDIUMJunos OS: MX Series: The bbe-smgd process crashes if an unsupported configuration exists and a PPPoE client sends a specific messageEPSS 0.4%