CWE-755— Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.— MITRE CWE catalog

610 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-755page 7 of 13

CVE-2021-39242HIGHCVSS 7.5EG 7.5
2021-08-17
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled.
CVE-2021-39659MEDIUMCVSS 5.5EG 5.5
2022-01-14
In sortSimPhoneAccountsForEmergency of CreateConnectionProcessor.java, there is a possible prevention of access to emergency calling due to an unhandled exception. In rare instances, this could lead to local denial of service with User exe…
CVE-2021-40391CRITICALCVSS 9.8EG 9.8
2021-11-19
An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code exec…
CVE-2021-40402HIGHCVSS 7.5EG 7.5
2022-04-14
An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.7.1 and 2.8.0. A specially-crafted Gerber file can lead to info…
CVE-2021-4105CRITICALCVSS 9.8EG 9.8
2023-02-24
Improper Handling of Parameters vulnerability in BG-TEK COSLAT Firewall allows Remote Code Inclusion. This issue affects COSLAT Firewall: from 5.24.0.R.20180630 before 5.24.0.R.20210727.
CVE-2021-42141CRITICALCVSS 9.8EG 9.8
2024-01-22
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with different epoch numbers in the packets Client_Hello, Client_key_exchange, and Change_cipher_spec, which may cause denial of serv…
CVE-2021-42142CRITICALCVSS 9.8EG 9.8
2024-01-23
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. This vulnerability allows remote attackers to cause a denial of service and false-positive packet d…
CVE-2021-42145HIGHCVSS 7.5EG 7.5
2024-01-24
An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cause a denial of service.
CVE-2021-42146HIGHCVSS 7.5EG 7.5
2024-01-24
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulner…
CVE-2021-43173HIGHCVSS 7.5EG 7.5
2021-11-09
In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. Wh…
CVE-2021-43272CRITICALCVSS 9.8EG 9.8
2021-11-14
An improper handling of exceptional conditions vulnerability exists in Open Design Alliance ODA Viewer sample before 2022.11. ODA Viewer continues to process invalid or malicious DWF files instead of stopping upon an exception. An attacker…
CVE-2021-43827MEDIUMCVSS 4.3EG 4.3
2021-12-14
discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tags (e.g. `<a>^[footnote]</a>`, the resulting rendered HTML would include a nested `<a>`, which is str…
CVE-2021-43979MEDIUMCVSS 5.3EG 5.3
2021-11-17
Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication,…
CVE-2021-46828HIGHCVSS 7.5EG 7.5
2022-07-20
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connect…
CVE-2021-46928MEDIUMCVSS 5.5EG 5.5
2024-02-27
In the Linux kernel, the following vulnerability has been resolved: parisc: Clear stale IIR value on instruction access rights trap When a trap 7 (Instruction access rights) occurs, this means the CPU couldn't execute an instruction due …
CVE-2022-0016HIGHCVSS 7.4EG 7.4
2022-02-10
An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticat…
CVE-2022-0023MEDIUMCVSS 5.9EG 5.9
2022-04-13
An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle (MITM) to send specifically crafted traffic to the firewall that causes…
CVE-2022-0264MEDIUMCVSS 5.5EG 5.5
2022-02-04
A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use…
CVE-2022-1965HIGHCVSS 8.1EG 8.1
2022-06-24
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be delet…
CVE-2022-20042MEDIUMCVSS 5.5EG 5.5
2022-02-09
In Bluetooth, there is a possible information disclosure due to incorrect error handling. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patc…
CVE-2022-20057MEDIUMCVSS 6.5EG 6.5
2022-03-10
In btif, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06271186; …
CVE-2022-20066MEDIUMCVSS 4.4EG 4.4
2022-04-11
In atf (hwfde), there is a possible leak of sensitive information due to incorrect error handling. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Pa…
CVE-2022-20076MEDIUMCVSS 4.4EG 4.4
2022-04-11
In ged, there is a possible memory corruption due to an incorrect error handling. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05838…
CVE-2022-20088HIGHCVSS 7.8EG 7.8
2022-05-03
In aee driver, there is a possible reference count mistake due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID…
CVE-2022-20111HIGHCVSS 8.4EG 8.4
2022-05-03
In ion, there is a possible use after free due to incorrect error handling. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS063…
CVE-2022-20253MEDIUMCVSS 6.5EG 6.5
2022-08-12
In Bluetooth, there is a possible cleanup failure due to an uncaught exception. This could lead to remote denial of service in Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Produc…
CVE-2022-20414MEDIUMCVSS 5.5EG 5.5
2022-11-08
In setImpl of AlarmManagerService.java, there is a possible way to put a device into a boot loop due to an uncaught exception. This could lead to local denial of service with no additional execution privileges needed. User interaction is n…
CVE-2022-20500MEDIUMCVSS 5.5EG 5.5
2022-12-13
In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitat…
CVE-2022-20678HIGHCVSS 8.6EG 8.6
2022-04-15
A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the inc…
CVE-2022-20726HIGHCVSS 5.5EG 7.5
2022-04-15
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying …
CVE-2022-20748MEDIUMCVSS 5.3EG 5.3
2022-05-03
A vulnerability in the local malware analysis process of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. This vulnerability …
CVE-2022-20854HIGHCVSS 7.5EG 7.5
2022-11-15
A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition …
CVE-2022-20919HIGHCVSS 8.6EG 8.6
2022-09-30
A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to unexpected…
CVE-2022-20920HIGHCVSS 7.7EG 7.7
2022-10-10
A vulnerability in the SSH implementation of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to improper handling of resources duri…
CVE-2022-21155HIGHCVSS 7.5EG 7.5
2022-04-12
A specially crafted packet sent to the Fernhill SCADA Server Version 3.77 and earlier may cause an exception, causing the server process (FHSvrService.exe) to exit.
CVE-2022-21218MEDIUMCVSS 5.5EG 5.5
2022-02-09
Uncaught exception in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2022-21667HIGHCVSS 7.5EG 7.5
2022-01-10
soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of …
CVE-2022-21676HIGHCVSS 7.5EG 7.5
2022-01-12
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the No…
CVE-2022-21813MEDIUMCVSS 6.1EG 6.1
2022-02-07
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can l…
CVE-2022-21814MEDIUMCVSS 6.1EG 6.1
2022-02-07
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, whi…
CVE-2022-21820MEDIUMCVSS 6.3EG 6.3
2022-03-24
NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may lead to limited code execution, some denial of service, escalation of privileges, and limited impa…
CVE-2022-22150HIGHCVSS 8.8EG 8.8
2022-02-04
A memory corruption vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A specially-crafted PDF document can trigger an exception which is improperly handled, leaving the engine in an inval…
CVE-2022-22174HIGHCVSS 7.5EG 7.5
2022-01-19
A vulnerability in the processing of inbound IPv6 packets in Juniper Networks Junos OS on QFX5000 Series and EX4600 switches may cause the memory to not be freed, leading to a packet DMA memory leak, and eventual Denial of Service (DoS) co…
CVE-2022-22177MEDIUMCVSS 5.3EG 5.3
2022-01-19
A release of illegal memory vulnerability in the snmpd daemon of Juniper Networks Junos OS, Junos OS Evolved allows an attacker to halt the snmpd daemon causing a sustained Denial of Service (DoS) to the service until it is manually restar…
CVE-2022-22202MEDIUMCVSS 6.5EG 6.5
2022-07-20
An Improper Handling of Exceptional Conditions vulnerability on specific PTX Series devices, including the PTX1000, PTX3000 (NextGen), PTX5000, PTX10002-60C, PTX10008, and PTX10016 Series, in Juniper Networks Junos OS allows an unauthentic…
CVE-2022-22265CRITICALCVSS 5.0EG 9.0⚠ KEV
2022-01-10
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
CVE-2022-22290MEDIUMCVSS 6.5EG 6.5
2022-01-14
Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted HTML page.
CVE-2022-22300HIGHCVSS 4.3EG 8.8
2022-03-01
A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 throug…
CVE-2022-23018HIGHCVSS 7.5EG 7.5
2022-01-25
On BIG-IP AFM version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and 13.1.x beginning in 13.1.3.4, when a virtual server is configured with both HTTP protocol security and HTTP Proxy Connect profiles, undisclosed…
CVE-2022-23121CRITICALCVSS 9.8EG 9.8
2023-03-28
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue…

Map vulnerabilities like CWE-755 to your infrastructure

EchelonGraph correlates every CVE — across CWE-755 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →