Weakness (CWE)
CWE-390: Detection of Error Condition Without Action
The product detects a specific error, but takes no actions to handle the error.
How to prevent it (3 mitigations)
-
Implementation
Properly handle each exception. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
-
Implementation
If a function returns an error, it is important to either fix the problem and try again, alert the user that an error has happened and let the program continue, or alert the user and close and cleanup the program.
-
Testing
Subject the product to extensive testing to discover some of the possible instances of where/how errors or return values are not handled. Consider testing techniques such as ad hoc, equivalence partitioning, robustness and fault tolerance, mutation, and fuzzing.
Source: MITRE CWE-390
15 results · Clear filters · Feed
-
Medium 5.6
Detection of error condition without action in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Do…
-
Medium 6.9
Sandboxie-Plus: Sandbox containment bypass
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing…
-
Medium 6.8
@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decima…
-
Medium 5.3
Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field values that the application intended to mask. To remediate this issue, users should upgrade to version 3.35.0.
-
Medium 4.3
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.
-
Medium 5.3
Libssh: libssh: denial of service via unchecked proxycommand fork() failure
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
-
Medium 4.4
pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root execution
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev/input/event* nodes, causing pusb_has_virtual_input_device() to return 0 (no virtual devices found) …
-
Medium 5.4
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the s…
-
Medium 6.6
Detection of Error Condition Without Action in Computer Vision
Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.
-
Medium 6.8CVE-2025-26465 Public exploit
Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific cond…
-
Medium 6.3
`gh attestation verify` returns incorrect exit code during verification if no attestations are present
`gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations …
-
Medium 6.1
Rsync: rsync server leaks arbitrary client files
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of …
-
Medium 5.9
Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.
-
Medium 5.3
HTTP/2: CPU exhaustion due to CONTINUATION frame flood
Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the client t…
-
Medium 5.8
A vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, rem…