Weakness (CWE)
CWE-390: Detection of Error Condition Without Action
The product detects a specific error, but takes no actions to handle the error.
How to prevent it (3 mitigations)
-
Implementation
Properly handle each exception. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
-
Implementation
If a function returns an error, it is important to either fix the problem and try again, alert the user that an error has happened and let the program continue, or alert the user and close and cleanup the program.
-
Testing
Subject the product to extensive testing to discover some of the possible instances of where/how errors or return values are not handled. Consider testing techniques such as ad hoc, equivalence partitioning, robustness and fault tolerance, mutation, and fuzzing.
Source: MITRE CWE-390
31 results · Feed
-
Medium 5.6
Detection of error condition without action in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Do…
-
Medium 6.9
Sandboxie-Plus: Sandbox containment bypass
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing…
-
High 7.5
Guest access to Firecracker process memory after a failed memory discard
Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snap…
-
High 7.4
Django REST framework: TokenProxy.delete() reports success and revokes nothing
Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a del…
-
Critical 9.8CVE-2026-111823 Public exploit
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
-
Medium 6.8
@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decima…
-
Critical 9.4
Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path (the voice gateway, or an equivalent position able to add, alter, or wi…
-
Medium 5.3
Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field values that the application intended to mask. To remediate this issue, users should upgrade to version 3.35.0.
-
Low 3.7
AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Di…
-
Medium 4.3
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.
-
High 7.8
util-linux libmount Privilege Escalation via Failed Mount Helper
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owne…
-
Medium 5.3
Libssh: libssh: denial of service via unchecked proxycommand fork() failure
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
-
Critical 9.1
Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users ar…
-
Critical 9.8
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_e…
-
Medium 4.4
pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root execution
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev/input/event* nodes, causing pusb_has_virtual_input_device() to return 0 (no virtual devices found) …
-
Critical 9.8
crypto: pcrypt - Fix handling of MAY_BACKLOG requests
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.
-
Medium 5.4
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the s…
-
Low 1.8
Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively…
-
High 7.8
Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without A…
-
Medium 6.6
Detection of Error Condition Without Action in Computer Vision
Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.
-
High 7.8
Detection of Error Condition Without Action in Hypervisor
Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.
-
Medium 6.8CVE-2025-26465 Public exploit
Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific cond…
-
Medium 6.3
`gh attestation verify` returns incorrect exit code during verification if no attestations are present
`gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations …
-
Medium 6.1
Rsync: rsync server leaks arbitrary client files
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of …
-
Medium 5.9
Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.
-
Medium 5.3
HTTP/2: CPU exhaustion due to CONTINUATION frame flood
Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the client t…
-
High 7.5CVE-2024-27919 EPSS 84%
HTTP/2: memory exhaustion due to CONTINUATION frame flood
Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. Envoy's HTTP/2 codec does not reset a request when header map limits have been exceed…
-
Medium 5.8
A vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, rem…
-
Critical 10.0
An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (c…
-
High 8.8
An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A …
-
Unscored —
In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that t…