Improper Handling of Exceptional Conditions
CWE-755
The product does not handle or incorrectly handles an exceptional condition.
We track 154 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0. 7 have been exploited in real attacks.
Latest Improper Handling of Exceptional Conditions vulnerabilities
- 7.5 High severity
go-merkledag: Unchecked Return Value
go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't a
- 7.5 High severity
Redmine: Improper Handling of Exceptional Conditions
Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user.
- 7.5 High severity
Cisco Firepower Management Center: Improper Handling of Exceptional Conditions
A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device
- 7.5 High severity
R1510: Improper Handling of Exceptional Conditions
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.
- 7.5 High severity
traefik: Improper Handling of Exceptional Conditions
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a
- 7.7 High severity
Cisco IOS: Improper Handling of Exceptional Conditions
A vulnerability in the SSH implementation of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to improper handling of resources during an exceptional sit
- 7.8 High severity
utodesk® AutoCAD®, Advance Steel and Civil 3D®: Improper Handling of Exceptional Conditions
A maliciously crafted PDF file when parsed through Autodesk AutoCAD 2023 causes an unhandled exception. An attacker can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code in the context of the current process.
- 7.8 High severity
Autodesk Maya: Improper Handling of Exceptional Conditions
A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2022, 2021, 2020, and Maya 2023 and 2022. The vulnerability exists because the application fails to handle crafted MODEL a
- 7.5 High severity
Cisco IOS: Improper Handling of Exceptional Conditions
A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting
- 7.5 High severity
Freebsd: Improper Handling of Exceptional Conditions
sys/netinet/tcp_timer.h in FreeBSD before 7.0 contains a denial-of-service (DoS) vulnerability due to improper handling of TSopt on TCP connections. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- 7.5 High severity
synapse: Improper Handling of Exceptional Conditions
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when det
- 7.5 High severity
Manageengine Firewall Analyzer: Improper Handling of Exceptional Conditions
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a us
- 8.1 High severity
Runtime Toolkit: Improper Handling of Exceptional Conditions
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction
- 7.8 High severity
Navisworks: Improper Handling of Exceptional Conditions
A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files in Autodesk Navisworks 2022. The vulnerability exists because the application fails to handle a crafted PDF file, which causes an unhandled
- 7.1 High severity
ESET NOD32 Antivirus: Improper Handling of Exceptional Conditions
Privilege escalation vulnerability in Windows products of ESET, spol. s r.o. allows attacker to exploit "Repair" and "Uninstall" features what may lead to arbitrary file deletion. This issue affects: ESET, spol. s r.o. ESET NOD32 Antivirus 11.2 versions prior
- 8.4 High severity
MT6580, MT6735, MT6737, MT6739, MT6750…: Improper Handling of Exceptional Conditions
In ion, there is a possible use after free due to incorrect error handling. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366069; Issue ID: ALPS
- 7.8 High severity
MT6580, MT6731, MT6739, MT6761, MT6762…: Improper Handling of Exceptional Conditions
In aee driver, there is a possible reference count mistake due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06209201; Issue
- 7.5 High severity
http-swagger: Improper Handling of Exceptional Conditions
http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The c
- 7.5 High severity
Cisco IOS: Improper Handling of Exceptional Conditions
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system
- 7.5 High severity
Cisco IOS XE Software: Improper Handling of Exceptional Conditions
A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of ce
- 7.5 High severity
PowerScale OneFS: Improper Handling of Exceptional Conditions
Dell PowerScale OneFS versions 8.2.x - 9.3.0.x contain a denial-of-service vulnerability in SmartConnect. An unprivileged network attacker may potentially exploit this vulnerability, leading to denial-of-service.
- 7.5 High severity
SCADA Server: Improper Handling of Exceptional Conditions
A specially crafted packet sent to the Fernhill SCADA Server Version 3.77 and earlier may cause an exception, causing the server process (FHSvrService.exe) to exit.
- 8.8 High severity
Fortinet FortiManager, FortiAnalyzer: Improper Handling of Exceptional Conditions
A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyze
- 7.8 High severity
GlobalProtect App: Improper Handling of Exceptional Conditions
An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Befo
- 8.8 High severity
Foxit: Improper Handling of Exceptional Conditions
A memory corruption vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A specially-crafted PDF document can trigger an exception which is improperly handled, leaving the engine in an invalid state, which can lea
- 7.5 High severity
BIG-IP AFM: Improper Handling of Exceptional Conditions
On BIG-IP AFM version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and 13.1.x beginning in 13.1.3.4, when a virtual server is configured with both HTTP protocol security and HTTP Proxy Connect profiles, undisclosed requests can cause t
- 7.5 High severity
Junos OS: Improper Handling of Exceptional Conditions
A release of illegal memory vulnerability in the snmpd daemon of Juniper Networks Junos OS, Junos OS Evolved allows an attacker to halt the snmpd daemon causing a sustained Denial of Service (DoS) to the service until it is manually restarted. This issue impac
- 7.5 High severity
Junos OS: Missing Release of Memory after Effective Lifetime
A vulnerability in the processing of inbound IPv6 packets in Juniper Networks Junos OS on QFX5000 Series and EX4600 switches may cause the memory to not be freed, leading to a packet DMA memory leak, and eventual Denial of Service (DoS) condition. Once the con
- 7.5 High severity
engine.io: Improper Handling of Exceptional Conditions
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This i
- 7.5 High severity
soketi: Improper Handling of Exceptional Conditions
soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an em
- 8.8 High severity
Google Chromium V8 Memory Corruption Exploited
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 9.8 Critical severity
OpenSMTPD Remote Code Execution Exploited
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects th
- 8.6 High severity
Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Exploited
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causin
- 9.8 Critical severity
Apache Struts Remote Code Execution Exploited
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted C