目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1310 元

100%
请我们喝杯咖啡

CWE-754 对因果或异常条件的不恰当检查 类漏洞列表 285

CWE-754 对因果或异常条件的不恰当检查 类弱点 285 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-754 属于异常条件检查不当漏洞，指软件未正确验证低频但关键的异常状态，如内存不足或权限受限。攻击者常通过耗尽资源或模拟恶意客户端触发这些未处理条件，导致服务拒绝或逻辑错误。开发者应完善错误处理机制，对所有预期外的系统状态进行严格校验与防御性编程，确保在极端情况下仍能安全降级或报错，避免程序崩溃或被利用。

MITRE CWE 官方描述
CWE：CWE-754 对异常或例外情况的检查不当 英文：产品未检查或不正确地检查了在日常操作中不期望频繁发生的异常或例外情况。 程序员可能假设某些事件或条件永远不会发生，或者无需担心，例如内存不足、由于权限限制导致无法访问资源，或者客户端或组件行为不端。然而，攻击者可能故意触发这些异常情况，从而违反程序员的假设，可能引入不稳定性、错误行为或漏洞。请注意，本条目并非专门针对异常（exceptions）和异常处理（exception handling）的使用，后者是用于检查和处理异常或意外情况的机制。
常见影响 (1)
Integrity, AvailabilityDoS: Crash, Exit, or Restart, Unexpected State
The data which were produced as a result of a function call could be in a bad state upon return. If the return value is not checked, then this bad data may be used in operations, possibly leading to a crash or other unintended behaviors.
缓解措施 (5)
RequirementsUse a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Choose languages with features such as exception handling that force the programmer to anticipate unusual conditions that may generate exceptions. Custom exceptions may need to be developed to handle unusual business-logic conditions. Be careful not to pass sensitive exceptions…
ImplementationCheck the results of all functions that return a value and verify that the value is expected.
Effectiveness: High
ImplementationIf using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).
Effectiveness: High
ImplementationEnsure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or…
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
代码示例 (2)
Consider the following code segment:
char buf[10], cp_buf[10]; fgets(buf, 10, stdin); strcpy(cp_buf, buf);
Bad · C
The following code does not check to see if memory allocation succeeded before attempting to use the pointer returned by malloc().
buf = (char*) malloc(req_size); strncpy(buf, xfer, req_size);
Bad · C
CVE ID标题CVSS风险等级Published
CVE-2025-12657 MongoDB Server 安全漏洞 — MongoDB Server 5.0 Medium2025-11-03
CVE-2025-10937 Oxford Nanopore Technologies MinKNOW 代码问题漏洞 — MinKNOW 5.5 Medium2025-10-23
CVE-2025-62605 Mastodon 代码问题漏洞 — mastodon 4.3 Medium2025-10-21
CVE-2025-11925 Azure Access Technology BLU-IC2和Azure Access Technology BLU-IC4 安全漏洞 — BLU-IC2 6.1AIMediumAI2025-10-17
CVE-2025-55035 Mattermost 安全漏洞 — Mattermost 6.1 Medium2025-10-16
CVE-2024-26008 Fortinet多款产品 代码问题漏洞 — FortiProxy 5.0 Medium2025-10-14
CVE-2025-60004 Juniper Networks Junos OS和Juniper Networks Junos OS Evolved 代码问题漏洞 — Junos OS 7.5 High2025-10-09
CVE-2025-59958 Juniper Junos OS Evolved 代码问题漏洞 — Junos OS Evolved 6.5 Medium2025-10-09
CVE-2025-58354 Kata Containers 代码问题漏洞 — kata-containers 8.8AIHighAI2025-09-23
CVE-2025-8716 OpenText Content Management 代码问题漏洞 — OpenText Content Management 6.5AIMediumAI2025-09-11
CVE-2025-9998 PcVue 安全漏洞 — PcVue 7.5AIHighAI2025-09-05
CVE-2025-24975 Firebird 代码问题漏洞 — firebird 7.1 High2025-08-15
CVE-2024-52504 Siemens多款产品 代码问题漏洞 — SIPROTEC 4 6MD61 7.5 High2025-08-12
CVE-2025-54463 Mattermost Confluence Plugin 安全漏洞 — Mattermost Confluence Plugin 5.9 Medium2025-08-11
CVE-2025-53514 Mattermost Confluence Plugin 安全漏洞 — Mattermost Confluence Plugin 5.9 Medium2025-08-11
CVE-2025-52931 Mattermost Confluence Plugin 安全漏洞 — Mattermost Confluence Plugin 7.5 High2025-08-11
CVE-2025-52136 EMQX 代码问题漏洞 — EMQX 3.0 Low2025-08-10
CVE-2025-41241 VMware vCenter 安全漏洞 — vCenter 4.4 Medium2025-07-29
CVE-2025-53638 Solady 代码问题漏洞 — solady 6.5AIMediumAI2025-07-17
CVE-2025-52981 Juniper Networks Junos OS 代码问题漏洞 — Junos OS 7.5 High2025-07-11
CVE-2025-4663 Broadcom Brocade Fabric OS 安全漏洞 — Brocade Fabric OS 6.5AIMediumAI2025-07-08
CVE-2025-53359 ethereum-rs 代码问题漏洞 — ethereum 7.4AIHighAI2025-07-02
CVE-2023-28910 Volkswagen MIB3 Infotainment 安全漏洞 — Volkswagen MIB3 infotainment system MIB3 OI MQB 8.0 High2025-06-28
CVE-2025-1718 Hitachi Relion 安全漏洞 — Relion 670/650 and SAM600-IO 6.5 Medium2025-06-24
CVE-2025-0130 Palo Alto Networks PAN-OS 安全漏洞 — Cloud NGFW 7.5AIHighAI2025-05-14
CVE-2024-12533 Phoenix SecureCore 安全漏洞 — SecureCore Technology 4 3.3 Low2025-05-13
CVE-2025-20201 Cisco IOS XE 代码问题漏洞 — Cisco IOS XE Software 6.7 Medium2025-05-07
CVE-2025-20200 Cisco IOS XE 代码问题漏洞 — Cisco IOS XE Software 6.7 Medium2025-05-07
CVE-2025-20198 Cisco IOS XE 代码问题漏洞 — Cisco IOS XE Software 4.6 Medium2025-05-07
CVE-2024-10635 Proofpoint Enterprise Protection 安全漏洞 — Enterprise Protection 6.1 Medium2025-04-28

CWE-754（对因果或异常条件的不恰当检查） 是常见的弱点类别，本平台收录该类弱点关联的 285 条 CVE 漏洞。