Falhas do tipo CWE-755

232 resultados

Tratamento inadequado de condições excepcionais

É quando o código não trata, trata de forma insuficiente ou de forma errada situações de erro e exceções. Isso pode deixar o software em estado inconsistente, ignorar falhas críticas ou executar código perigoso quando algo dá errado, compromentendo segurança, integridade ou disponibilidade.

Exemplo

Um servidor Web recebe uma requisição mal formada e falha ao parsear JSON; em vez de retornar erro 400, simplesmente pula a validação e processa dados vazios, ou uma conexão de banco de dados cai e a aplicação continua operando com dados em cache desatualizado sem avisar o usuário.

Como mitigar

Sempre trate exceções explicitamente: capture erros conhecidos e faça rollback/limpeza apropriada, log de falhas para auditoria, e retorne respostas claras ao usuário. Use type hints e validação de entrada antes de processar, e considere parar o sistema de forma segura se a exceção for crítica.

CVE-2021-43173—Hanging RRDP requestEPSS 1.4%CVE-2025-10156CRITICALPickleScan Security Bypass via Bad CRC in ZIP ArchiveEPSS 1.4%CVE-2020-7926MEDIUMSpecific query can cause a DoS against MongoDB ServerEPSS 1.4%CVE-2019-8462—In a rare scenario, Check Point R80.30 Security Gateway before JHF Take 50 managed by Check Point R80.30 Management crashes with a unique coEPSS 1.3%CVE-2019-0060HIGHJunos OS: SRX Series: flowd process crash due to processing of specific transit IP packetsEPSS 1.3%CVE-2026-23666HIGH.NET Framework Denial of Service VulnerabilityEPSS 1.3%CVE-2021-40402CRITICALAn out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (cEPSS 1.3%CVE-2020-25691—A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause denial-of-service by accessing a file with a large moEPSS 1.3%CVE-2020-7923MEDIUMSpecific GeoQuery can cause DoS against MongoDB ServerEPSS 1.3%CVE-2022-35295—In SAP Host Agent (SAPOSCOL) - version 7.22, an attacker may use files created by saposcol to escalate privileges for themselves.EPSS 1.3%CVE-2023-28631MEDIUMAttacker controlled data in AST nodes is not validated in comrakEPSS 1.3%CVE-2022-23495HIGHProtoNode may be modified such that common method calls may panic in ipfs/go-merkledagEPSS 1.3%CVE-2022-23625MEDIUMDoS vulnerability: Malformed Resource IdentifiersEPSS 1.2%CVE-2021-42141HIGHAn issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with different epoch numbers in thEPSS 1.2%CVE-2021-31353HIGHJunos OS and Junos OS Evolved: RPD core upon receipt of specific BGP updateEPSS 1.1%CVE-2020-1744MEDIUMA flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, tEPSS 1.1%CVE-2023-26479MEDIUMorg.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional ConditionsEPSS 1.1%CVE-2019-0051MEDIUMSRX5000 Series: Denial of Service vulnerability in SSL-Proxy feature.EPSS 1.1%CVE-2020-1632HIGHJunos OS and Junos OS Evolved: Invalid BGP UPDATE sent to peer device may cause BGP session to terminate.EPSS 1.1%CVE-2024-28869HIGHPossible denial of service vulnerability with Content-length header in TraefikEPSS 1.0%