cve.bz

CWE-248: Uncaught Exception, page 7

Filter

An exception is thrown from a function, but it is not caught.

What the weakness is: CWE-248 at MITRE

Ask an AI about CWE-248

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-248: Uncaught Exception and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/248.html and https://cve.bz/cve/cwe/248?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2023-27318EPSS 0.7%

    StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.13 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to a crash of the Local Distribution Router (LDR) service.

  2. 6.5CVE-2024-0754EPSS 0.4%

    Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122.

  3. 6.5CVE-2023-5310EPSS 0.3%

    A denial of service vulnerability exists in all Silicon Labs Z-Wave controller and endpoint devices running Z-Wave SDK v7.20.3 (Gecko SDK v4.3.3) and earlier. This attack can be carried out only by devices on the network sending a stream o…

  4. 7.8CVE-2023-22292EPSS 0.2%

    Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access.

  5. 6.5CVE-2023-22290EPSS 0.7%

    Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network access.

  6. 8.6CVE-2023-20086EPSS 0.7%

    A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This v…

  7. 7.5CVE-2023-46239EPSS 1.0%

    quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil p…

  8. 7.5CVE-2023-46135EPSS 1.0%

    rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len` should not above 64. This vulnerability has been patched in version 0.0.8.

  9. 6.5CVE-2023-25526EPSS 0.3%

    NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exception by injecting a crafted packet. A successful exploit may lead to denial of service.

  10. 7.5CVE-2023-42447EPSS 0.6%

    blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due …

  11. 7.5CVE-2023-42444EPSS 0.9%

    phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the pho…

  12. 7.5CVE-2023-4785EPSS 0.8%

    Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. No…

  13. 8.4CVE-2023-23774EPSS 0.2%

    Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt on the device's serial port in case of an unhandled exception. This allows an attacker with physical …

  14. 7.5CVE-2023-39948EPSS 1.0%

    eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is not caught in Fast DDS. This can remotely…

  15. 7.5CVE-2023-39945EPSS 0.9%

    eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a data submessage sent to PDP port raises unhandled `BadParamException`…

  16. 4.9CVE-2023-3774EPSS 0.7%

    An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.

  17. 7.5CVE-2023-38504EPSS 0.9%

    Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the s…

  18. 7.5CVE-2023-1691EPSS 0.4%

    Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.

  19. 7.5CVE-2023-3405EPSS 0.8%

    Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service

  20. 6.5CVE-2023-31125EPSS 1.3%

    Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socke…

  21. 7.5CVE-2023-2251EPSS 1.1%

    Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.

  22. 5.5CVE-2023-21087EPSS 0.09%

    In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exp…

  23. 6.5CVE-2023-29520EPSS 0.5%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object. This…

  24. 6.7CVE-2023-20628EPSS 0.09%

    In thermal, there is a possible memory corruption due to an uncaught exception. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS074944…

  25. 7.5CVE-2023-22941EPSS 1.0%

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).

  26. 8.8CVE-2023-0790EPSS 0.7%

    Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.

  27. 7.5CVE-2023-23932EPSS 0.7%

    OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS applications that are exposed to untrusted RTPS network traffic may crash when parsing badly-formed input. This issu…

  28. 7.5CVE-2023-0158EPSS 0.7%

    NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the "/rrdp" endpoint. Prior to 0.12.1 a direct query for any existing directory under "/rrdp/", rather than an RRDP file such as "/rr…

  29. 7.5CVE-2023-22477EPSS 1.1%

    Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`. This issue was patched in #940. As a workaround…

  30. 7.5CVE-2022-38166EPSS 0.7%

    In F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler crashes. This can lead to a scanning engine crash, triggerable remotely by an attacker for denial of…

  31. 5.1CVE-2022-3500EPSS 0.3%

    A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestatio…

  32. 6.5CVE-2022-41940EPSS 2.1%

    Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the No…

  33. 7.5CVE-2022-39386EPSS 0.8%

    @fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it …

  34. 7.5CVE-2022-20919EPSS 1.2%

    A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to unexpected…

  35. 5.3CVE-2022-36046EPSS 1.2%

    Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict `unhandled…

  36. 5.5CVE-2022-1975EPSS 0.2%

    There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-space.

  37. 5.9CVE-2022-31015EPSS 1.5%

    Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread…

  38. 7.5CVE-2021-41545EPSS 0.9%

    A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). When the…

  39. 6.5CVE-2022-20761EPSS 0.4%

    A vulnerability in the integrated wireless access point (AP) packet processing of the Cisco 1000 Series Connected Grid Router (CGR1K) could allow an unauthenticated, adjacent attacker to cause a denial of service condition on an affected d…

  40. 5.3CVE-2022-20675EPSS 1.3%

    A vulnerability in the TCP/IP stack of Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Secure Email and Web Manager, formerly Security Management Appliance, could allow an unauthenticated, remote attacke…

  41. 7.5CVE-2022-24822EPSS 1.7%

    Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to …

  42. 7.5CVE-2021-33010EPSS 1.1%

    An exception is thrown from a function in AVEVA System Platform versions 2017 through 2020 R2 P01, but it is not caught, which may cause a denial-of-service condition.

  43. 4.3CVE-2021-25971EPSS 1.0%

    In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file

  44. 7.5CVE-2021-37714EPSS 6.7%

    jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that cau…

  45. 6.5CVE-2021-36802EPSS 1.0%

    Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the p…

  46. 5.5CVE-2021-32694EPSS 1.0%

    Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched…

  47. 5.5CVE-2021-3038EPSS 0.2%

    A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BS…

  48. 7.5CVE-2020-15796EPSS 1.6%

    A vulnerability has been identified in SIMATIC ET 200SP Open Controller (incl. SIPLUS variants) (V20.8), SIMATIC S7-1500 Software Controller (V20.8). The web server of the affected products contains a vulnerability that could allow a remot…

  49. 7.5CVE-2020-6019EPSS 2.8%

    Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBase::Received_Data(), leading to an exception thrown from libprotobuf and resulting in a crash.

  50. 6.5CVE-2020-27121EPSS 1.2%

    A vulnerability in Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P) Software could allow an authenticated, remote attacker to cause the Cisco XCP Authentication Service on an affected device to restart, …