Fallos del tipo CWE-476

2177 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2023-21758HIGHWindows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityEPSS 92.5%CVE-2023-21547HIGHInternet Key Exchange (IKE) Protocol Denial of Service VulnerabilityEPSS 89.3%CVE-2021-44224—Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlierEPSS 82.3%CVE-2023-38171HIGHMicrosoft QUIC Denial of Service VulnerabilityEPSS 69.5%CVE-2021-34798—NULL pointer dereference in httpd coreEPSS 64.5%CVE-2025-21285HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 54.8%CVE-2022-44793MEDIUMhandle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be uEPSS 53.5%CVE-2022-44792MEDIUMhandle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used byEPSS 52.1%CVE-2017-15120HIGHAn issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference wheEPSS 51.8%CVE-2021-31618—NULL pointer dereference on specially crafted HTTP/2 requestEPSS 51.5%CVE-2020-17525—Remote unauthenticated denial-of-service in Subversion mod_authz_svnEPSS 40.1%CVE-2019-3995—ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. A remote unauthenticated atEPSS 28.5%CVE-2024-37399HIGHA NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, reEPSS 27.8%CVE-2021-41524—null pointer dereference in h2 fuzzingEPSS 25.2%CVE-2019-5010MEDIUMAn exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafteEPSS 21.4%CVE-2011-1271HIGHThe JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handlEPSS 20.1%CVE-2017-3169—In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_prEPSS 20.0%CVE-2016-10708HIGHsshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-seEPSS 15.7%CVE-2021-34586HIGHCODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)EPSS 13.1%CVE-2025-1103HIGHD-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereferenceEPSS 13.0%