CWE-755— Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.— MITRE CWE catalog

653 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-755page 6 of 14

CVE-2020-26160HIGHCVSS 7.5EG 7.5
2020-09-30
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a se…
CVE-2020-25869HIGHCVSS 7.5EG 7.5
2020-09-27
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
CVE-2020-5622HIGHCVSS 7.5EG 7.5
2020-09-02
Shadankun Server Security Type (excluding normal blocking method types) Ver.1.5.3 and earlier allows remote attackers to cause a denial of service which may result in not being able to add newly detected attack source IP addresses as block…
CVE-2020-2075HIGHCVSS 7.5EG 7.5
2020-08-31
Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x – CLV65x, ICR890-3, LMS10x, LMS11x, LMS15x, LMS12x, LMS13x, LMS14x, LMS5xx, LMS53x,…
CVE-2020-3338HIGHCVSS 7.5EG 7.5
2020-08-27
A vulnerability in the Protocol Independent Multicast (PIM) feature for IPv6 networks (PIM6) of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vu…
CVE-2020-13410HIGHCVSS 7.5EG 7.5
2020-08-26
An issue was discovered in MoscaJS Aedes 0.42.0. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream.
CVE-2020-10604HIGHCVSS 7.5EG 7.5
2020-07-25
In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requests. This can result in blocking connections and queries to PI Data Archive.
CVE-2020-1639HIGHCVSS 7.5EG 7.5
2020-04-08
When an attacker sends a specific crafted Ethernet Operation, Administration, and Maintenance (Ethernet OAM) packet to a target device, it may improperly handle the incoming malformed data and fail to sanitize this incoming data resulting …
CVE-2018-21088HIGHCVSS 7.5EG 7.5
2020-04-08
An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can cause a reboot because InputMethodManagerService has an unprotected system service. The Samsung ID is SVE-2017-9995 (January 2018).
CVE-2018-21091HIGHCVSS 7.5EG 7.5
2020-04-08
An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. Telecom has a System Crash via abnormal exception handling. The Samsung ID is SVE-2017-10906 (January 2018).
CVE-2017-18682HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. Because of incorrect exception handling and an unprotected intent, AudioService can cause a system crash, The Samsung IDs are SVE-2017…
CVE-2017-18678HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software. An attacker can crash system processes via a Serializable object because of missing exception handling. The Samsung IDs are SVE-2017-8…
CVE-2017-18671HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.x) software. Intents related to Wi-Fi have incorrect exception handling, leading to a crash of system processes. The Samsung ID is SVE-2017-8389 (May 2017).
CVE-2017-18670HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. android.intent.action.SIOP_LEVEL_CHANGED allows a serializable intent reboot. The Samsung ID is SVE-2017-8363 (May 2017).
CVE-2017-18663HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with N(7.x) software. Because of missing Intent exception handling, system_server can have a NullPointerException with a crash of a system process. The Samsung IDs are SVE-2017-9122, SVE-20…
CVE-2016-11026HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. BootReceiver allows attackers to trigger a system crash because of incorrect exception handling. The Samsung ID is SVE-2016-7118 (December 201…
CVE-2020-10101HIGHCVSS 7.5EG 7.5
2020-03-05
An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of t…
CVE-2020-5403HIGHCVSS 7.5EG 7.5
2020-03-03
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
CVE-2019-16302HIGHCVSS 7.5EG 7.5
2020-02-20
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the Ethernet VPN application (org.onosproject.evpnopenflow), the host event listener does not handle the following event types: HOST_MOVED, HOST_UPDATED. In combinati…
CVE-2019-16301HIGHCVSS 7.5EG 7.5
2020-02-20
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual tenant network application (org.onosproject.vtn), the host event listener does not handle the following event types: HOST_MOVED. In combination with other…
CVE-2019-16300HIGHCVSS 7.5EG 7.5
2020-02-20
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the access control application (org.onosproject.acl), the host event listener does not handle the following event types: HOST_REMOVED. In combination with other appli…
CVE-2019-16299HIGHCVSS 7.5EG 7.5
2020-02-20
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the mobility application (org.onosproject.mobility), the host event listener does not handle the following event types: HOST_ADDED, HOST_REMOVED, HOST_UPDATED. In com…
CVE-2019-16298HIGHCVSS 7.5EG 7.5
2020-02-20
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual broadband network gateway application (org.onosproject.virtualbng), the host event listener does not handle the following event types: HOST_MOVED, HOST_RE…
CVE-2019-16297HIGHCVSS 7.5EG 7.5
2020-02-20
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the P4 tutorial application (org.onosproject.p4tutorial), the host event listener does not handle the following event types: HOST_MOVED, HOST_REMOVED, HOST_UPDATED. I…
CVE-2015-2688HIGHCVSS 7.5EG 7.5
2020-01-24
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit)…
CVE-2019-19313HIGHCVSS 7.5EG 7.5
2020-01-05
GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits.
CVE-2019-20218HIGHCVSS 7.5EG 7.5
2020-01-02
selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
CVE-2019-14853HIGHCVSS 7.5EG 7.5
2019-11-26
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
CVE-2019-11177HIGHCVSS 7.5EG 7.5
2019-11-14
Unhandled exception in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
CVE-2012-1109HIGHCVSS 7.5EG 7.5
2019-11-12
mwlib 0.13 through 0.13.4 has a denial of service vulnerability when parsing #iferror magic functions
CVE-2019-10222HIGHCVSS 7.5EG 7.5
2019-11-08
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a r…
CVE-2011-4625HIGHCVSS 7.5EG 7.5
2019-11-06
simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.
CVE-2019-0060HIGHCVSS 7.5EG 7.5
2019-10-09
The flowd process, responsible for forwarding traffic in SRX Series services gateways, may crash and restart when processing specific transit IP packets through an IPSec tunnel. Continued processing of these packets may result in an extend…
CVE-2019-16866HIGHCVSS 7.5EG 7.5
2019-10-03
Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.
CVE-2019-8462HIGHCVSS 7.5EG 7.5
2019-10-02
In a rare scenario, Check Point R80.30 Security Gateway before JHF Take 50 managed by Check Point R80.30 Management crashes with a unique configuration of enhanced logging.
CVE-2019-0203HIGHCVSS 7.5EG 7.5
2019-09-26
In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.
CVE-2019-16901HIGHCVSS 7.5EG 7.5
2019-09-26
Advantech WebAccess/HMI Designer 2.1.9.31 has Exception Handler Chain corruption starting at Unknown Symbol @ 0x0000000000000000 called from ntdll!RtlRaiseStatus+0x00000000000000b4.
CVE-2019-6829HIGHCVSS 7.5EG 7.5
2019-09-17
A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prior to V3.10), which could cause a possible denial of service when writing to specific memory address…
CVE-2019-6828HIGHCVSS 7.5EG 7.5
2019-09-17
A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V3.10), Modicon Premium (all versions), and Modicon Quantum (all versions), which could cause a poss…
CVE-2019-6809HIGHCVSS 7.5EG 7.5
2019-09-17
A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions prior to V3.10), Modicon Premium (all versions), Modicon Quantum (all versions), which could cause a pos…
CVE-2019-9009HIGHCVSS 7.5EG 7.5
2019-09-17
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.
CVE-2019-11777HIGHCVSS 7.5EG 7.5
2019-09-11
In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another an…
CVE-2019-11694HIGHCVSS 7.5EG 7.5
2019-07-23
A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information…
CVE-2019-7846HIGHCVSS 7.5EG 7.5
2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-10977HIGHCVSS 7.5EG 7.5
2019-05-23
In Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior, an attacker could send crafted TCP packets against the FTP service, forcing the target devices to enter an error mode and cause a denial-of-s…
CVE-2019-6807HIGHCVSS 7.5EG 7.5
2019-05-22
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of service when writing sensitive application variables to the c…
CVE-2018-7852HIGHCVSS 7.5EG 7.5
2019-05-22
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when an invalid private command parameter is sent to the control…
CVE-2018-7849HIGHCVSS 7.5EG 7.5
2019-05-22
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a possible Denial of Service due to improper data integrity check when sending file…
CVE-2019-10742HIGHCVSS 7.5EG 7.5
2019-05-07
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.
CVE-2019-3565HIGHCVSS 7.5EG 7.5
2019-05-06
Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the…

Map vulnerabilities like CWE-755 to your infrastructure

EchelonGraph correlates every CVE — across CWE-755 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →