目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-754 对因果或异常条件的不恰当检查 类漏洞列表 329

CWE-754 对因果或异常条件的不恰当检查 类弱点 329 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-754 属于异常条件检查不当漏洞，指软件未正确验证低频但关键的异常状态，如内存不足或权限受限。攻击者常通过耗尽资源或模拟恶意客户端触发这些未处理条件，导致服务拒绝或逻辑错误。开发者应完善错误处理机制，对所有预期外的系统状态进行严格校验与防御性编程，确保在极端情况下仍能安全降级或报错，避免程序崩溃或被利用。

MITRE CWE 官方描述
CWE：CWE-754 对异常或例外情况的检查不当 英文：产品未检查或不正确地检查了在日常操作中不期望频繁发生的异常或例外情况。 程序员可能假设某些事件或条件永远不会发生，或者无需担心，例如内存不足、由于权限限制导致无法访问资源，或者客户端或组件行为不端。然而，攻击者可能故意触发这些异常情况，从而违反程序员的假设，可能引入不稳定性、错误行为或漏洞。请注意，本条目并非专门针对异常（exceptions）和异常处理（exception handling）的使用，后者是用于检查和处理异常或意外情况的机制。
常见影响 (1)
Integrity, Availability DoS: Crash, Exit, or Restart, Unexpected State
The data which were produced as a result of a function call could be in a bad state upon return. If the return value is not checked, then this bad data may be used in operations, possibly leading to a crash or other unintended behaviors.
缓解措施 (5)
Requirements Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Choose languages with features such as exception handling that force the programmer to anticipate unusual conditions that may generate exceptions. Custom exceptions may need to be developed to handle unusual business-logic conditions. Be careful not to pass sensitive exceptions…
Implementation Check the results of all functions that return a value and verify that the value is expected.
Effectiveness: High
Implementation If using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).
Effectiveness: High
Implementation Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or…
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
代码示例 (2)
Consider the following code segment:
char buf[10], cp_buf[10]; fgets(buf, 10, stdin); strcpy(cp_buf, buf);
Bad · C
The following code does not check to see if memory allocation succeeded before attempting to use the pointer returned by malloc().
buf = (char*) malloc(req_size); strncpy(buf, xfer, req_size);
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2021-31361 Juniper Networks Junos OS 代码问题漏洞 — Junos OS 5.3 Medium 2021-10-19
CVE-2021-31351 Juniper Networks Junos OS 代码问题漏洞 — Junos OS 7.5 High 2021-10-19
CVE-2021-25481 Samsung SMR 代码问题漏洞 — Samsung Mobile Devices 6.4 Medium 2021-10-06
CVE-2021-39162 Caleb Doxsey pomerium 代码问题漏洞 — pomerium 8.6 High 2021-09-09
CVE-2021-33605 vaadin 代码问题漏洞 — Vaadin 4.3 Medium 2021-08-25
CVE-2021-32780 Envoy 代码问题漏洞 — envoy 8.6 High 2021-08-24
CVE-2021-21563 DELL EMC PowerScale 代码问题漏洞 — PowerScale OneFS 6.5 Medium 2021-08-02
CVE-2021-0288 Juniper Networks Junos OS 代码问题漏洞 — Junos OS 6.5 Medium 2021-07-15
CVE-2021-0287 Juniper Networks Junos OS Evolved 代码问题漏洞 — Junos OS 6.5 Medium 2021-07-15
CVE-2021-0282 Juniper Networks Junos OS 代码问题漏洞 — Junos OS 7.5 High 2021-07-15
CVE-2021-0281 Juniper Networks Junos OS 代码问题漏洞 — Junos OS 5.9 Medium 2021-07-15
CVE-2021-32946 Open Design Alliance Drawings SDK 代码问题漏洞 — Drawings SDK 7.8 - 2021-06-17
CVE-2021-21439 OTRS AG OTRS 输入验证错误漏洞 — ((OTRS)) Community Edition 6.5 Medium 2021-06-14
CVE-2020-36382 OpenVPN 代码问题漏洞 — OpenVPN Access Server 7.5 - 2021-06-04
CVE-2021-22747 Triconex Model 3009 MP 代码问题漏洞 — Triconex Model 3009 MP installed on Tricon V11.3.x systems 3.9 - 2021-05-26
CVE-2021-22746 Triconex Model 3009 MP 代码问题漏洞 — Triconex Model 3009 MP installed on Tricon V11.3.x systems 3.9 - 2021-05-26
CVE-2021-22745 Triconex Model 3009 MP 代码问题漏洞 — Triconex Model 3009 MP installed on Tricon V11.3.x systems 3.9 - 2021-05-26
CVE-2021-22744 Triconex Model 3009 MP 代码问题漏洞 — Triconex Model 3009 MP installed on Tricon V11.3.x systems 3.9 - 2021-05-26
CVE-2021-22743 Triconex Model 3009 MP 代码问题漏洞 — Triconex TCM 4351B installed on Tricon V11.3.x systems. 3.9 - 2021-05-26
CVE-2021-22742 Triconex Model 3009 MP 代码问题漏洞 — Triconex Model 3009 MP installed on Tricon V11.3.x systems 3.9 - 2021-05-26
CVE-2021-29607 Google TensorFlow 代码问题漏洞 — tensorflow 5.3 Medium 2021-05-14
CVE-2021-29531 Google TensorFlow 代码问题漏洞 — tensorflow 2.5 Low 2021-05-14
CVE-2021-29533 Google TensorFlow 代码问题漏洞 — tensorflow 2.5 Low 2021-05-14
CVE-2021-29534 Google TensorFlow 代码问题漏洞 — tensorflow 2.5 Low 2021-05-14
CVE-2021-29544 Google TensorFlow 代码问题漏洞 — tensorflow 2.5 Low 2021-05-14
CVE-2018-25007 Vaadin flow 代码问题漏洞 — Vaadin 2.6 Low 2021-04-23
CVE-2021-0239 Juniper Networks Junos OS 代码问题漏洞 — Junos OS Evolved 6.5 Medium 2021-04-22
CVE-2021-0236 Juniper Networks Junos OS 代码问题漏洞 — Junos OS 6.5 Medium 2021-04-22
CVE-2021-0228 Juniper Networks Junos OS 代码问题漏洞 — Junos OS 6.5 Medium 2021-04-22
CVE-2021-0225 Juniper Networks Junos OS 代码问题漏洞 — Junos OS Evolved 5.8 Medium 2021-04-22

CWE-754（对因果或异常条件的不恰当检查） 是常见的弱点类别，本平台收录该类弱点关联的 329 条 CVE 漏洞。