cve.bz

CWE-754: Improper Check for Unusual or Exceptional Conditions, page 10

Filter

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

What the weakness is: CWE-754 at MITRE

Ask an AI about CWE-754

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-754: Improper Check for Unusual or Exceptional Conditions and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/754.html and https://cve.bz/cve/cwe/754?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2022-45854EPSS 0.3%

    An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to cause a temporary denial-of-service (DoS) by sending crafted VLAN frames if the MAC address of the vu…

  2. 9.8CVE-2022-45788EPSS 1.2%

    A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the cont…

  3. 5.3CVE-2023-0572EPSS 0.7%

    Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.

  4. 7.5CVE-2023-22393EPSS 0.6%

    An Improper Check for Unusual or Exceptional Conditions vulnerability in BGP route processing of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause Routing Protocol Daemon (RPD) crash by sending a BGP route with inv…

  5. 8.2CVE-2022-43393EPSS 0.6%

    An improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70(ABMH.8)C0, which could allow an unauthenticated attacker to corrupt the contents of the memory and…

  6. 9.8CVE-2017-20166EPSS 1.3%

    Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.

  7. 5.3CVE-2021-44856EPSS 0.5%

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be created via Special:ChangeContentModel due to the mishandling of the EditFilterMergedContent hook ret…

  8. 5.3CVE-2022-37392EPSS 1.2%

    Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

  9. 7.5CVE-2022-32749EPSS 1.4%

    Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions. This issue affects Apache Traffic Server: from 8.0.0 through 9.…

  10. 6.7CVE-2022-20588EPSS 0.1%

    In sysmmu_map of sysmmu.c, there is a possible EoP due to a precondition check failure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: Andr…

  11. 8.2CVE-2022-29278EPSS 0.2%

    Incorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory Incorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory. This issue was discovered by Insyd…

  12. 5.3CVE-2022-20950EPSS 0.9%

    A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This vulnerability is due to a lac…

  13. 8.2CVE-2022-26079EPSS 0.2%

    Improper conditions check in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via local access.

  14. 5.5CVE-2022-20426EPSS 0.09%

    In multiple functions of many files, there is a possible obstruction of the user's ability to select a phone account due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. Use…

  15. 7.5CVE-2022-3616EPSS 0.5%

    Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service.…

  16. 6.5CVE-2022-22238EPSS 0.3%

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). W…

  17. 7.5CVE-2022-22235EPSS 0.7%

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based, attacker to cause Denial of Service (DoS). A P…

  18. 5.3CVE-2022-22227EPSS 0.7%

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX7000 Series allows an unauthenticated network-based attacker to cause a partial Denial o…

  19. 7.5CVE-2022-22218EPSS 0.5%

    On SRX Series devices, an Improper Check for Unusual or Exceptional Conditions when using Certificate Management Protocol Version 2 (CMPv2) auto re-enrollment, allows a network-based, unauthenticated attacker to cause a Denial of Service (…

  20. 5.3CVE-2022-41587EPSS 0.5%

    Uncaptured exceptions in the home screen module. Successful exploitation of this vulnerability may affect stability.

  21. 7.5CVE-2022-39288EPSS 59%

    fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content-Type header. An attacker can send an invalid Content-Type header that can cause…

  22. 8.6CVE-2022-20837EPSS 1.0%

    A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This…

  23. 6.7CVE-2022-32590EPSS 0.1%

    In wlan, there is a possible use after free due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07299425…

  24. 6.8CVE-2021-35108EPSS 0.2%

    Improper checking of AP-S lock bit while verifying the secure resource group permissions can lead to non secure read and write access in Snapdragon Connectivity, Snapdragon Mobile

  25. 5.3CVE-2022-36046EPSS 1.2%

    Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict `unhandled…

  26. 7.5CVE-2022-38152EPSS 2.9%

    An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created t…

  27. 7.5CVE-2022-27563EPSS 0.8%

    An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.

  28. 7.5CVE-2022-35173EPSS 1.4%

    An issue was discovered in Nginx NJS v0.7.5. The JUMP offset for a break instruction was not set to a correct offset during code generation, leading to a segmentation violation.

  29. 5.5CVE-2022-38235EPSS 0.3%

    XPDF commit ffaf11c was discovered to contain a segmentation violation via DCTStream::getChar() at /xpdf/Stream.cc.

  30. 5.5CVE-2022-38234EPSS 0.3%

    XPDF commit ffaf11c was discovered to contain a segmentation violation via Lexer::getObj(Object*) at /xpdf/Lexer.cc.

  31. 5.5CVE-2022-38233EPSS 0.3%

    XPDF commit ffaf11c was discovered to contain a segmentation violation via DCTStream::readMCURow() at /xpdf/Stream.cc.

  32. 5.5CVE-2022-36145EPSS 0.3%

    SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::Reader::getWord().

  33. 5.5CVE-2022-36141EPSS 0.3%

    SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::MethodBody::write(SWF::Writer*, SWF::Context*).

  34. 5.5CVE-2022-36140EPSS 0.3%

    SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::DeclareFunction2::write(SWF::Writer*, SWF::Context*).

  35. 6.5CVE-2022-35473EPSS 0.9%

    OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7.

  36. 6.5CVE-2022-35469EPSS 0.8%

    OTFCC v0.10.4 was discovered to contain a segmentation violation via /x86_64-linux-gnu/libc.so.6+0xbb384.

  37. 6.5CVE-2022-22217EPSS 0.3%

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS). The issue is caused by…

  38. 7.5CVE-2022-26078EPSS 0.9%

    Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a duplicate IP address. This issue affects: Gallagher Gallagher Controller 6000 vCR8.60 versions prior to 220303a; vCR8.50 versions prio…

  39. 7.5CVE-2022-31103EPSS 1.5%

    lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule `@keyframes`. This package is depended …

  40. 7.5CVE-2022-31093EPSS 1.7%

    NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is conv…

  41. 9.8CVE-2022-20130EPSS 8.5%

    In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not neede…

  42. 4.3CVE-2022-30738EPSS 0.6%

    Improper check in Loader in Samsung Internet prior to 17.0.1.69 allows attackers to spoof address bar via executing script.

  43. 7.5CVE-2022-23712EPSS 7.5%

    A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.

  44. 7.5CVE-2022-29369EPSS 1.2%

    Nginx NJS v0.7.2 was discovered to contain a segmentation violation via njs_lvlhsh_bucket_find at njs_lvlhsh.c.

  45. 7.5CVE-2022-29473EPSS 0.8%

    On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an IPSec ALG profile is configured on a virtual server, undisclosed responses can cause Traffic Management Microke…

  46. 7.5CVE-2022-28706EPSS 0.8%

    On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions …

  47. 5.3CVE-2022-26130EPSS 0.9%

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an Active mode-enabled FTP profile is configured on a virtual server, undisclos…

  48. 4.4CVE-2022-28793EPSS 0.2%

    Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot cycle after compromising TEE. The patch is applied in Galaxy S22 to prevent chan…

  49. 5.3CVE-2022-24880EPSS 1.2%

    flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.…

  50. 6.5CVE-2022-20804EPSS 0.4%

    A vulnerability in the Cisco Discovery Protocol of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, adjacent attacker to …