目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-754 对因果或异常条件的不恰当检查 类漏洞列表 329

CWE-754 对因果或异常条件的不恰当检查 类弱点 329 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-754 属于异常条件检查不当漏洞，指软件未正确验证低频但关键的异常状态，如内存不足或权限受限。攻击者常通过耗尽资源或模拟恶意客户端触发这些未处理条件，导致服务拒绝或逻辑错误。开发者应完善错误处理机制，对所有预期外的系统状态进行严格校验与防御性编程，确保在极端情况下仍能安全降级或报错，避免程序崩溃或被利用。

MITRE CWE 官方描述
CWE：CWE-754 对异常或例外情况的检查不当 英文：产品未检查或不正确地检查了在日常操作中不期望频繁发生的异常或例外情况。 程序员可能假设某些事件或条件永远不会发生，或者无需担心，例如内存不足、由于权限限制导致无法访问资源，或者客户端或组件行为不端。然而，攻击者可能故意触发这些异常情况，从而违反程序员的假设，可能引入不稳定性、错误行为或漏洞。请注意，本条目并非专门针对异常（exceptions）和异常处理（exception handling）的使用，后者是用于检查和处理异常或意外情况的机制。
常见影响 (1)
Integrity, Availability DoS: Crash, Exit, or Restart, Unexpected State
The data which were produced as a result of a function call could be in a bad state upon return. If the return value is not checked, then this bad data may be used in operations, possibly leading to a crash or other unintended behaviors.
缓解措施 (5)
Requirements Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Choose languages with features such as exception handling that force the programmer to anticipate unusual conditions that may generate exceptions. Custom exceptions may need to be developed to handle unusual business-logic conditions. Be careful not to pass sensitive exceptions…
Implementation Check the results of all functions that return a value and verify that the value is expected.
Effectiveness: High
Implementation If using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).
Effectiveness: High
Implementation Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or…
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
代码示例 (2)
Consider the following code segment:
char buf[10], cp_buf[10]; fgets(buf, 10, stdin); strcpy(cp_buf, buf);
Bad · C
The following code does not check to see if memory allocation succeeded before attempting to use the pointer returned by malloc().
buf = (char*) malloc(req_size); strncpy(buf, xfer, req_size);
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2021-1446 Cisco IOS XE Software 代码问题漏洞 — Cisco IOS XE Software 8.6 High 2021-03-24
CVE-2020-27274 Honeywell OPC UA Tunneller 代码问题漏洞 — OPC UA Tunneller 7.5 - 2021-01-26
CVE-2020-24677 ABB Symphony Plus Operations 和 ABB Symphony Plus Historian 代码问题漏洞 — ABB Ability™ Symphony® Plus Operations 8.8 High 2020-12-22
CVE-2020-7549 Schneider Electric Modicon M340 代码问题漏洞 — Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) 5.3 - 2020-12-11
CVE-2020-7543 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions) 7.5 - 2020-12-11
CVE-2020-7542 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions) 7.5 - 2020-12-11
CVE-2020-7539 多款 Schneider Electric 产品代码问题漏洞 — Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) 7.5 - 2020-12-11
CVE-2020-7537 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions) 7.5 - 2020-12-11
CVE-2020-7536 Schneider Electric Modicon M340 代码问题漏洞 — Modicon M340 CPUs (BMXP34* versions prior to V3.30) and Modicon M340 Communication Ethernet modules (BMXNOE0100 (H) versions prior to V3.4, BMXNOE0110 (H) versions prior to V6.6, and BMXNOR0200H all versions) 7.5 - 2020-12-11
CVE-2020-7538 Schneider Electric EcoStruxure Control Expert 代码问题漏洞 — PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) 7.5 - 2020-11-19
CVE-2020-1999 Palo Alto Networks PAN-OS 代码问题漏洞 — PAN-OS 5.3 Medium 2020-11-12
CVE-2020-16125 gdm3 代码问题漏洞 — GDM3 7.2 High 2020-11-10
CVE-2020-3421 Cisco IOS XE Software Zone-Based Firewall 代码问题漏洞 — Cisco IOS XE Software 8.6 High 2020-09-24
CVE-2020-3480 Cisco IOS XE Zone-Based Firewall feature 代码问题漏洞 — Cisco IOS XE Software 8.6 High 2020-09-24
CVE-2020-5420 Cloud Foundry 代码问题漏洞 — Routing 7.7 - 2020-09-03
CVE-2020-3449 Cisco IOS XR 代码问题漏洞 — Cisco IOS XR Software 4.3 Medium 2020-08-17
CVE-2020-7477 多款Schneider Electric产品代码问题漏洞 — Modicon Quantum Ethernet Network module and Quantum / Premium COPRO (Quantum Ethernet Network module 140NOE771x1, versions 7.0 and prior, Quantum processors with integrated Ethernet – 140CPU65xxxxx, all versions, Premium processors with integrated Ethernet, all versions) 7.5 - 2020-03-23
CVE-2020-5215 Google TensorFlow 输入验证错误漏洞 — TensorFlow 5.0 Medium 2020-01-28
CVE-2019-15989 Cisco IOS XR 代码问题漏洞 — Cisco IOS XR Software 6.8 - 2020-01-26
CVE-2018-7794 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) 7.5 - 2020-01-06
CVE-2019-6857 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) 7.5 - 2020-01-06
CVE-2019-6856 多款Schneider Electric产品代码问题漏洞 — Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) 7.5 - 2020-01-06
CVE-2019-11779 Eclipse Mosquitto 代码问题漏洞 — Eclipse Mosquitto 8.1 - 2019-09-19
CVE-2019-6813 Schneider Electric Modicon M340和BMXNOR0200H Ethernet/Serial RTU module 代码问题漏洞 — BMXNOR0200H Ethernet / Serial RTU module 7.5 - 2019-09-17
CVE-2019-6811 Schneider Electric Quantum 140 NOE771x1 代码问题漏洞 — Modicon Quantum 140 NOE771x1 7.5 - 2019-09-17
CVE-2019-6833 多款Schneider Electric产品代码问题漏洞 — Magelis HMI Panels 7.5 - 2019-09-17
CVE-2019-6831 Schneider Electric BMXNOR0200H Ethernet/Serial RTU module 代码问题漏洞 — BMXNOR0200H Ethernet / Serial RTU module 7.5 - 2019-09-17
CVE-2019-6819 多款Schneider Electric产品代码问题漏洞 — Modicon Controllers, Modicon M340 - firmware versions prior to V3.01 Modicon M580 - firmware versions prior to V2.80 All firmware versions of Modicon Quantum and Modicon Premium 7.5 - 2019-05-22
CVE-2019-1849 Cisco IOS XR Software 代码问题漏洞 — Cisco IOS XR Software 6.5 - 2019-05-16

CWE-754（对因果或异常条件的不恰当检查） 是常见的弱点类别，本平台收录该类弱点关联的 329 条 CVE 漏洞。