CWE-248
Uncaught Exception
Description
An exception is thrown from a function, but it is not caught.
Hierarchy (View 1000)
CVEs mapped to this weakness (273)
page 8 of 14| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-0754 | Med | 0.42 | 6.5 | 0.00 | Jan 23, 2024 | Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122. | ||
| CVE-2023-22290 | Med | 0.42 | 6.5 | 0.01 | Nov 14, 2023 | Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network access. | ||
| CVE-2023-46239 | Hig | 0.42 | 7.5 | 0.01 | Oct 31, 2023 | quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic)… | ||
| CVE-2023-25526 | Med | 0.42 | 6.5 | 0.00 | Sep 20, 2023 | NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exception by injecting a crafted packet. A successful exploit may lead to denial of service. | ||
| CVE-2023-4785 | Hig | 0.42 | 7.5 | 0.01 | Sep 13, 2023 | Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are… | ||
| CVE-2022-25024 | Hig | 0.42 | 7.5 | 0.01 | Aug 22, 2023 | The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service. | ||
| CVE-2023-38504 | Hig | 0.42 | 7.5 | 0.01 | Jul 27, 2023 | Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js`… | ||
| CVE-2023-2251 | Hig | 0.42 | 7.5 | 0.01 | Apr 24, 2023 | Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5. | ||
| CVE-2023-22941 | Med | 0.42 | 6.5 | 0.01 | Feb 14, 2023 | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd). | ||
| CVE-2023-0790 | Hig | 0.42 | 7.6 | 0.01 | Feb 12, 2023 | Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11. | ||
| CVE-2022-39386 | Hig | 0.42 | 7.5 | 0.01 | Nov 8, 2022 | @fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been… | ||
| CVE-2022-24434 | Hig | 0.42 | 7.5 | 0.03 | May 20, 2022 | This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes. | ||
| CVE-2022-21227 | Hig | 0.42 | 7.5 | 0.02 | May 1, 2022 | The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine. | ||
| CVE-2022-24822 | Hig | 0.42 | 7.5 | 0.02 | Apr 6, 2022 | Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior… | ||
| CVE-2019-25055 | Hig | 0.42 | 7.5 | 0.01 | Dec 27, 2021 | An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary. | ||
| CVE-2021-36802 | Med | 0.42 | 6.5 | 0.01 | Aug 4, 2021 | Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product. | ||
| CVE-2021-23900 | Hig | 0.42 | 7.5 | 0.02 | Jan 13, 2021 | OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations. | ||
| CVE-2019-7474 | Med | 0.42 | 6.5 | 0.01 | Apr 2, 2019 | A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloading certificate with specific extension. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3,… | ||
| CVE-2026-13697 | Hig | 0.41 | 7.4 | 0.00 | Jul 29, 2026 | undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default… | ||
| CVE-2026-27819 | Hig | 0.40 | 7.2 | 0.01 | Feb 25, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP… |
- risk 0.42cvss 6.5epss 0.00
Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122.
- risk 0.42cvss 6.5epss 0.01
Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network access.
- risk 0.42cvss 7.5epss 0.01
quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic)…
- risk 0.42cvss 6.5epss 0.00
NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exception by injecting a crafted packet. A successful exploit may lead to denial of service.
- risk 0.42cvss 7.5epss 0.01
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are…
- risk 0.42cvss 7.5epss 0.01
The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.
- risk 0.42cvss 7.5epss 0.01
Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js`…
- risk 0.42cvss 7.5epss 0.01
Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.
- risk 0.42cvss 6.5epss 0.01
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).
- risk 0.42cvss 7.6epss 0.01
Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- risk 0.42cvss 7.5epss 0.01
@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been…
- risk 0.42cvss 7.5epss 0.03
This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.
- risk 0.42cvss 7.5epss 0.02
The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.
- risk 0.42cvss 7.5epss 0.02
Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior…
- risk 0.42cvss 7.5epss 0.01
An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.
- risk 0.42cvss 6.5epss 0.01
Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product.
- risk 0.42cvss 7.5epss 0.02
OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.
- risk 0.42cvss 6.5epss 0.01
A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloading certificate with specific extension. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3,…
- risk 0.41cvss 7.4epss 0.00
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default…
- risk 0.40cvss 7.2epss 0.01
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP…