CWE-391: Unchecked Error Condition
Filter
deprecated by MITRE see CWE-252, CWE-1069, CWE-248, CWE-754, CWE-755
This entry has been deprecated because it used ambiguous terminology and incorporated and confused multiple weaknesses. See Mapping Notes for other recommendations, and see Maintenance Notes for more detailed explanations.
What the weakness is: CWE-391 at MITRE. OWASP Top 10: A10:2025 Mishandling of Exceptional Conditions
Ask an AI about CWE-391
Show the prompt
Explain CWE-391: Unchecked Error Condition and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/391.html and https://cve.bz/cve/cwe/391?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.5CVE-2026-67080EPSS 0.3%
HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system deta…
- 7.1CVE-2026-56727EPSS 0.2%
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported …
- 9.3CVE-2026-74900EPSS 0.6%
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and pub…
- 9.3CVE-2025-71325EPSS 0.6%
picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers ca…
- 9.8CVE-2024-52316EPSS 6.2%
Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without e…
- 6.1CVE-2022-20849EPSS 0.3%
A vulnerability in the Broadband Network Gateway PPP over Ethernet (PPPoE) feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the PPPoE process to continually crash. This vulnerability exists …
- 8.2CVE-2024-23326EPSS 0.4%
Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rf…
- 5.3CVE-2023-32871EPSS 0.08%
In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS…
- 5.3CVE-2023-0572EPSS 0.7%
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
- 6.5CVE-2022-22160EPSS 0.4%
An Unchecked Error Condition vulnerability in the subscriber management daemon (smgd) of Juniper Networks Junos OS allows an unauthenticated adjacent attacker to cause a crash of and thereby a Denial of Service (DoS). In a subscriber manag…
- 6.5CVE-2020-14383EPSS 2.2%
A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an a…
- 7.5CVE-2019-14853EPSS 2.4%
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
- 8.6CVE-2016-10526EPSS 1.6%
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the …
- 5.5CVE-2018-1091EPSS 0.4%
In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor featu…
- 9.8CVE-2017-12187EPSS 3.3%
xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 9.8CVE-2017-12186EPSS 4.3%
xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 9.8CVE-2017-12185EPSS 4.2%
xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 9.8CVE-2017-12184EPSS 4.2%
xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 9.8CVE-2017-12183EPSS 4.5%
xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 9.8CVE-2017-12182EPSS 4.2%
xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 9.8CVE-2017-12181EPSS 4.2%
xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 9.8CVE-2017-12180EPSS 4.5%
xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 9.8CVE-2017-12179EPSS 4.4%
xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 9.8CVE-2017-12178EPSS 4.4%
xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 9.8CVE-2017-12177EPSS 4.4%
xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 9.8CVE-2017-12176EPSS 4.2%
xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- 7.0CVE-2017-7496EPSS 0.3%
fedora-arm-installer up to and including 1.99.16 is vulnerable to local privilege escalation due to lack of checking the error condition of mount operation failure on unsafely created temporary directories.