目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1000 CNY

100.0%
コーヒーを一杯おごる

CWE-754 对因果或异常条件的不恰当检查 类漏洞列表 272

CWE-754 对因果或异常条件的不恰当检查 类弱点 272 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-754 属于异常条件检查不当漏洞，指软件未正确验证低频但关键的异常状态，如内存不足或权限受限。攻击者常通过耗尽资源或模拟恶意客户端触发这些未处理条件，导致服务拒绝或逻辑错误。开发者应完善错误处理机制，对所有预期外的系统状态进行严格校验与防御性编程，确保在极端情况下仍能安全降级或报错，避免程序崩溃或被利用。

MITRE CWE 官方描述
CWE：CWE-754 对异常或例外情况的检查不当 英文：产品未检查或不正确地检查了在日常操作中不期望频繁发生的异常或例外情况。 程序员可能假设某些事件或条件永远不会发生，或者无需担心，例如内存不足、由于权限限制导致无法访问资源，或者客户端或组件行为不端。然而，攻击者可能故意触发这些异常情况，从而违反程序员的假设，可能引入不稳定性、错误行为或漏洞。请注意，本条目并非专门针对异常（exceptions）和异常处理（exception handling）的使用，后者是用于检查和处理异常或意外情况的机制。
常见影响 (1)
Integrity, AvailabilityDoS: Crash, Exit, or Restart, Unexpected State
The data which were produced as a result of a function call could be in a bad state upon return. If the return value is not checked, then this bad data may be used in operations, possibly leading to a crash or other unintended behaviors.
缓解措施 (5)
RequirementsUse a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Choose languages with features such as exception handling that force the programmer to anticipate unusual conditions that may generate exceptions. Custom exceptions may need to be developed to handle unusual business-logic conditions. Be careful not to pass sensitive exceptions…
ImplementationCheck the results of all functions that return a value and verify that the value is expected.
Effectiveness: High
ImplementationIf using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).
Effectiveness: High
ImplementationEnsure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or…
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
代码示例 (2)
Consider the following code segment:
char buf[10], cp_buf[10]; fgets(buf, 10, stdin); strcpy(cp_buf, buf);
Bad · C
The following code does not check to see if memory allocation succeeded before attempting to use the pointer returned by malloc().
buf = (char*) malloc(req_size); strncpy(buf, xfer, req_size);
Bad · C
CVE IDタイトルCVSS深刻度公開日
CVE-2021-0236 Junos OS: A specific BGP VPNv6 flowspec message causes routing protocol daemon (rpd) process to crash with a core. — Junos OS 6.5 Medium2021-04-22
CVE-2021-0228 Junos OS: MX Series: DDoS LACP violation upon receipt of specific layer 2 frames in EVPN-VXLAN deployment — Junos OS 6.5 Medium2021-04-22
CVE-2021-0225 Junos OS Evolved: Stateless IP firewall filter does not work as expected — Junos OS Evolved 5.8 Medium2021-04-22
CVE-2021-1446 Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service Vulnerability — Cisco IOS XE Software 8.6 High2021-03-24
CVE-2020-27274 Honeywell OPC UA Tunneller 代码问题漏洞 — OPC UA Tunneller 7.5 -2021-01-26
CVE-2020-24677 Insecure Web Service in Symphony Plus — ABB Ability™ Symphony® Plus Operations 8.8 High2020-12-22
CVE-2020-7549 Schneider Electric Modicon M340 代码问题漏洞 — Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) 5.3 -2020-12-11
CVE-2020-7543 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions) 7.5 -2020-12-11
CVE-2020-7542 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions) 7.5 -2020-12-11
CVE-2020-7539 多款 Schneider Electric 产品代码问题漏洞 — Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) 7.5 -2020-12-11
CVE-2020-7537 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions) 7.5 -2020-12-11
CVE-2020-7536 Schneider Electric Modicon M340 代码问题漏洞 — Modicon M340 CPUs (BMXP34* versions prior to V3.30) and Modicon M340 Communication Ethernet modules (BMXNOE0100 (H) versions prior to V3.4, BMXNOE0110 (H) versions prior to V6.6, and BMXNOR0200H all versions) 7.5 -2020-12-11
CVE-2020-7538 Schneider Electric EcoStruxure Control Expert 代码问题漏洞 — PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) 7.5 -2020-11-19
CVE-2020-1999 PAN-OS: Threat signatures are evaded by specifically crafted packets — PAN-OS 5.3 Medium2020-11-12
CVE-2020-16125 gdm3 would start gnome-initial-setup if it cannot contact accountservice — GDM3 7.2 High2020-11-10
CVE-2020-3421 Cisco IOS XE Software Zone-Based Firewall Denial of Service Vulnerabilities — Cisco IOS XE Software 8.6 High2020-09-24
CVE-2020-3480 Cisco IOS XE Software Zone-Based Firewall Denial of Service Vulnerabilities — Cisco IOS XE Software 8.6 High2020-09-24
CVE-2020-5420 Gorouter is vulnerable to DoS attack via invalid HTTP responses — Routing 7.7 -2020-09-03
CVE-2020-3449 Cisco IOS XR Software Additional Paths Denial of Service Vulnerability — Cisco IOS XR Software 4.3 Medium2020-08-17
CVE-2020-7477 多款Schneider Electric产品代码问题漏洞 — Modicon Quantum Ethernet Network module and Quantum / Premium COPRO (Quantum Ethernet Network module 140NOE771x1, versions 7.0 and prior, Quantum processors with integrated Ethernet – 140CPU65xxxxx, all versions, Premium processors with integrated Ethernet, all versions) 7.5 -2020-03-23
CVE-2020-5215 Segmentation faultin TensorFlow when converting a Python string to tf.float16 — TensorFlow 5.0 Medium2020-01-28
CVE-2019-15989 Cisco IOS XR Software Border Gateway Protocol Attribute Denial of Service Vulnerability — Cisco IOS XR Software 6.8 -2020-01-26
CVE-2018-7794 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) 7.5 -2020-01-06
CVE-2019-6857 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) 7.5 -2020-01-06
CVE-2019-6856 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) 7.5 -2020-01-06
CVE-2019-11779 Eclipse Mosquitto 代码问题漏洞 — Eclipse Mosquitto 8.1 -2019-09-19
CVE-2019-6813 Schneider Electric Modicon M340和BMXNOR0200H Ethernet/Serial RTU module 代码问题漏洞 — BMXNOR0200H Ethernet / Serial RTU module 7.5 -2019-09-17
CVE-2019-6811 Schneider Electric Quantum 140 NOE771x1 代码问题漏洞 — Modicon Quantum 140 NOE771x1 7.5 -2019-09-17
CVE-2019-6833 多款Schneider Electric产品代码问题漏洞 — Magelis HMI Panels 7.5 -2019-09-17
CVE-2019-6831 Schneider Electric BMXNOR0200H Ethernet/Serial RTU module 代码问题漏洞 — BMXNOR0200H Ethernet / Serial RTU module 7.5 -2019-09-17

CWE-754（对因果或异常条件的不恰当检查） 是常见的弱点类别，本平台收录该类弱点关联的 272 条 CVE 漏洞。