cve.bz

OWASP A10:2025 Mishandling of Exceptional Conditions vulnerabilities, newest first, page 116

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A10:2025 at MITRE.

Its weaknesses: 24

CWE-209, CWE-215, CWE-234, CWE-235, CWE-248, CWE-252, CWE-274, CWE-280, CWE-369, CWE-390, CWE-391, CWE-394, CWE-396, CWE-397, CWE-460, CWE-476, CWE-478, CWE-484, CWE-550, CWE-636, CWE-703, CWE-754, CWE-755, CWE-756

  1. 5.5CVE-2023-3220EPSS 0.2%

    An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference.

  2. 6.5CVE-2023-3316EPSS 1.1%

    A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.

  3. 7.5CVE-2023-25733EPSS 0.6%

    The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox < 110.

  4. 7.5CVE-2023-35849EPSS 0.6%

    VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a packet.

  5. 6.8CVE-2023-34733EPSS 0.5%

    A lack of exception handling in the Volkswagen Discover Media Infotainment System Software Version 0876 allows attackers to cause a Denial of Service (DoS) via supplying crafted media files when connecting a device to the vehicle's USB plu…

  6. 6.5CVE-2023-33307EPSS 0.6%

    A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.

  7. 6.5CVE-2023-33306EPSS 0.8%

    A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to denial of sslvpn service via specifically crafted request in bookmark parameter.

  8. 5.5CVE-2023-21137EPSS 0.1%

    In several methods of JobStore.java, uncaught exceptions in job map parsing could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVe…

  9. 5.3CVE-2023-34449EPSS 1.0%

    ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, eith…

  10. 7.8CVE-2023-32008EPSS 0.7%

    Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

  11. 6.5CVE-2023-24938EPSS 2.0%

    Windows CryptoAPI Denial of Service Vulnerability

  12. 5.5CVE-2023-33121EPSS 0.2%

    A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V13.3 (All versions < V13.3.0.10), Teamcenter Visualization V14.0 (All versions <…

  13. 5.5CVE-2022-48445EPSS 0.08%

    In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  14. 5.5CVE-2022-48444EPSS 0.08%

    In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  15. 5.5CVE-2022-48443EPSS 0.08%

    In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  16. 5.5CVE-2022-48442EPSS 0.07%

    In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  17. 7.5CVE-2023-24510EPSS 0.6%

    On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.

  18. 3.3CVE-2023-3044EPSS 0.3%

    An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code. This is related to CVE-2022-30524, but the problem here is caused by a very large p…

  19. 8.8CVE-2023-29539EPSS 0.7%

    When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to instal…

  20. 6.5CVE-2023-23602EPSS 0.6%

    A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affec…

  21. 3.3CVE-2023-34339EPSS 0.2%

    In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message

  22. 6.5CVE-2023-32716EPSS 0.6%

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL command to cause a denial of service by crashing the Splunk d…

  23. 5.5CVE-2023-33461EPSS 0.4%

    iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getstring's return.

  24. 7.1CVE-2023-3013EPSS 0.3%

    Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.

  25. 7.8CVE-2023-3012EPSS 0.4%

    NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.

  26. 7.5CVE-2022-47525EPSS 0.8%

    Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote attacker could leverage this vulnerability to cause a denial-of-service. Exploitation of this issue does not require user…

  27. 7.5CVE-2023-2953EPSS 2.0%

    A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

  28. 5.3CVE-2023-33181EPSS 0.5%

    Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of…

  29. 7.7CVE-2023-0779EPSS 0.5%

    At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.

  30. 7.5CVE-2023-33973EPSS 1.0%

    RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send a crafted frame which is forwarded by the device. D…

  31. 7.5CVE-2023-24825EPSS 1.0%

    RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer …

  32. 7.5CVE-2023-32695EPSS 1.1%

    socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node…

  33. 4.7CVE-2023-2898EPSS 0.2%

    There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.

  34. 6.5CVE-2023-1667EPSS 1.3%

    A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.

  35. 7.8CVE-2023-2480EPSS 0.2%

    Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications

  36. 5.5CVE-2023-2875EPSS 0.3%

    A vulnerability, which was classified as problematic, was found in eScan Antivirus 22.0.1400.2443. Affected is the function 0x22E008u in the library PROCOBSRVESX.SYS of the component IoControlCode Handler. The manipulation leads to null po…

  37. 5.5CVE-2023-2872EPSS 0.3%

    A vulnerability classified as problematic has been found in FlexiHub 5.5.14691.0. This affects the function 0x220088 in the library fusbhub.sys of the component IoControlCode Handler. The manipulation leads to null pointer dereference. An …

  38. 5.5CVE-2023-2871EPSS 0.4%

    A vulnerability was found in FabulaTech USB for Remote Desktop 6.1.0.0. It has been rated as problematic. Affected by this issue is the function 0x220448/0x220420/0x22040c/0x220408 of the component IoControlCode Handler. The manipulation l…

  39. 9.8CVE-2023-2840EPSS 0.7%

    NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.

  40. 7.5CVE-2023-2839EPSS 0.6%

    Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2.

  41. 5.5CVE-2023-28514EPSS 0.2%

    IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace. IBM X-Force ID: 250398.

  42. 7.5CVE-2023-24832EPSS 0.7%

    A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this i…

  43. 5.3CVE-2022-4870EPSS 0.4%

    In affected versions of Octopus Deploy it is possible to discover network details via error message

  44. 5.5CVE-2023-2731EPSS 0.4%

    A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompr…

  45. 5.5CVE-2023-21103EPSS 0.10%

    In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for e…

  46. 7.8CVE-2023-21102EPSS 0.2%

    In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User inte…

  47. 5.5CVE-2023-2662EPSS 0.3%

    In Xpdf 4.04 (and earlier), a bad color space object in the input PDF file can cause a divide-by-zero.

  48. 4.3CVE-2023-29195EPSS 1.0%

    Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that f…

  49. 5.5CVE-2022-42878EPSS 0.2%

    Null pointer dereference for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 may allow an authenticated user to potentially enable information disclosure via local access.

  50. 7.8CVE-2022-29508EPSS 0.2%

    Null pointer dereference in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable escalation of privilege via local access.