目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-754 对因果或异常条件的不恰当检查 类漏洞列表 329

CWE-754 对因果或异常条件的不恰当检查 类弱点 329 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-754 属于异常条件检查不当漏洞，指软件未正确验证低频但关键的异常状态，如内存不足或权限受限。攻击者常通过耗尽资源或模拟恶意客户端触发这些未处理条件，导致服务拒绝或逻辑错误。开发者应完善错误处理机制，对所有预期外的系统状态进行严格校验与防御性编程，确保在极端情况下仍能安全降级或报错，避免程序崩溃或被利用。

MITRE CWE 官方描述
CWE：CWE-754 对异常或例外情况的检查不当 英文：产品未检查或不正确地检查了在日常操作中不期望频繁发生的异常或例外情况。 程序员可能假设某些事件或条件永远不会发生，或者无需担心，例如内存不足、由于权限限制导致无法访问资源，或者客户端或组件行为不端。然而，攻击者可能故意触发这些异常情况，从而违反程序员的假设，可能引入不稳定性、错误行为或漏洞。请注意，本条目并非专门针对异常（exceptions）和异常处理（exception handling）的使用，后者是用于检查和处理异常或意外情况的机制。
常见影响 (1)
Integrity, Availability DoS: Crash, Exit, or Restart, Unexpected State
The data which were produced as a result of a function call could be in a bad state upon return. If the return value is not checked, then this bad data may be used in operations, possibly leading to a crash or other unintended behaviors.
缓解措施 (5)
Requirements Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Choose languages with features such as exception handling that force the programmer to anticipate unusual conditions that may generate exceptions. Custom exceptions may need to be developed to handle unusual business-logic conditions. Be careful not to pass sensitive exceptions…
Implementation Check the results of all functions that return a value and verify that the value is expected.
Effectiveness: High
Implementation If using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).
Effectiveness: High
Implementation Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or…
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
代码示例 (2)
Consider the following code segment:
char buf[10], cp_buf[10]; fgets(buf, 10, stdin); strcpy(cp_buf, buf);
Bad · C
The following code does not check to see if memory allocation succeeded before attempting to use the pointer returned by malloc().
buf = (char*) malloc(req_size); strncpy(buf, xfer, req_size);
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-40343 free5GC 代码问题漏洞 — udr 5.3AI Medium AI 2026-04-21
CVE-2026-40249 free5GC 安全漏洞 — free5gc 9.1AI Critical AI 2026-04-16
CVE-2025-43883 Dell PowerScale OneFS 安全漏洞 — PowerScale OneFS 4.1 Medium 2026-04-16
CVE-2026-33790 Juniper Networks Junos OS SRX 代码问题漏洞 — Junos OS 7.5 High 2026-04-09
CVE-2026-33787 Juniper Networks Junos OS SRX 代码问题漏洞 — Junos OS 5.5 Medium 2026-04-09
CVE-2026-33781 Juniper Networks Junos OS EX/QFX 代码问题漏洞 — Junos OS 6.5 Medium 2026-04-09
CVE-2026-33774 Juniper Networks Junos OS MX 代码问题漏洞 — Junos OS 6.5 Medium 2026-04-09
CVE-2026-33786 Juniper Networks Junos OS SRX 代码问题漏洞 — Junos OS 5.5 Medium 2026-04-09
CVE-2026-40069 BSV Ruby SDK 代码问题漏洞 — bsv-ruby-sdk 7.5 High 2026-04-09
CVE-2026-31790 OpenSSL 安全漏洞 — OpenSSL 7.5AI High AI 2026-04-07
CVE-2026-39395 cosign 代码问题漏洞 — cosign 4.3 Medium 2026-04-07
CVE-2026-33939 handlebars 代码问题漏洞 — handlebars.js 7.5 High 2026-03-27
CVE-2026-3109 Mattermost 安全漏洞 — Mattermost 2.2 Low 2026-03-26
CVE-2026-20719 Mattermost 安全漏洞 — Mattermost 4.3 Medium 2026-03-25
CVE-2026-0230 Palo Alto Networks Cortex XDR Broker VM 安全漏洞 — Cortex XDR Agent 6.0AI Medium AI 2026-03-11
CVE-2026-30900 Zoom Clients for Windows 安全漏洞 — Zoom Workplace 7.8 High 2026-03-11
CVE-2026-22760 Dell Device Management Agent 代码问题漏洞 — Device Management Agent (DDMA) 3.3 Low 2026-03-04
CVE-2025-69250 free5GC 代码问题漏洞 — udm 5.3 - 2026-02-23
CVE-2026-0229 Palo Alto Networks PAN-OS 安全漏洞 — Cloud NGFW 7.5AI High AI 2026-02-11
CVE-2026-25639 Axios 代码问题漏洞 — axios 7.5 High 2026-02-09
CVE-2026-0944 Drupal Group invite 安全漏洞 — Group invite - - AI 2026-02-04
CVE-2026-24513 Kubernetes ingress-nginx 安全漏洞 — ingress-nginx 3.1 Low 2026-02-03
CVE-2026-20419 MediaTek Chipsets 安全漏洞 — MediaTek chipset 6.5AI Medium AI 2026-02-02
CVE-2025-15542 TP-Link VX800v 安全漏洞 — VX800v v1.0 7.5AI High AI 2026-01-29
CVE-2026-24054 Kata Containers 代码问题漏洞 — kata-containers 3.8 - 2026-01-29
CVE-2025-14840 Drupal HTTP Client Manager 安全漏洞 — HTTP Client Manager - - AI 2026-01-28
CVE-2026-22796 OpenSSL 安全漏洞 — OpenSSL 7.5AI High AI 2026-01-27
CVE-2026-22795 OpenSSL 安全漏洞 — OpenSSL 7.5AI High AI 2026-01-27
CVE-2025-69420 OpenSSL 安全漏洞 — OpenSSL 6.2AI Medium AI 2026-01-27
CVE-2025-12387 Pix-Link LV-WR21Q 代码问题漏洞 — LV-WR21Q 7.5AI High AI 2026-01-27

CWE-754（对因果或异常条件的不恰当检查） 是常见的弱点类别，本平台收录该类弱点关联的 329 条 CVE 漏洞。