CWE-755— Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.— MITRE CWE catalog

614 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-755page 1 of 13

CVE-2006-5170HIGHCVSS v2 7.5EG 7.5
2006-10-10
pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which…
CVE-2008-4302MEDIUMCVSS 5.5EG 5.5
2008-09-29
fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to c…
CVE-2009-5043CRITICALCVSS 9.8EG 9.8
2019-10-31
burn allows file names to escape via mishandled quotation marks
CVE-2011-2336MEDIUMCVSS 6.5EG 6.5
2019-11-07
An issue exists in WebKit in Google Chrome before Blink M12. when clearing lists in AnimationControllerPrivate that signal when a hardware animation starts.
CVE-2011-2807MEDIUMCVSS 6.5EG 6.5
2019-11-07
Incorrect handling of timer information in Timer.cpp in WebKit in Google Chrome before Blink M13.
CVE-2011-4625HIGHCVSS 7.5EG 7.5
2019-11-06
simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.
CVE-2012-1109HIGHCVSS 7.5EG 7.5
2019-11-12
mwlib 0.13 through 0.13.4 has a denial of service vulnerability when parsing #iferror magic functions
CVE-2013-4584MEDIUMCVSS 5.9EG 5.9
2019-11-15
Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers not being applied to STARTTLS connections
CVE-2014-1943MEDIUMCVSS v2 5.0EG 5.0
2014-02-18
Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.
CVE-2015-2688HIGHCVSS 7.5EG 7.5
2020-01-24
buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit)…
CVE-2016-11026HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. BootReceiver allows attackers to trigger a system crash because of incorrect exception handling. The Samsung ID is SVE-2016-7118 (December 201…
CVE-2016-11034MEDIUMCVSS 6.5EG 6.5
2020-04-07
An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. The decode function in Qjpeg in Qt 5.7 allows attackers to trigger a system crash via a malformed image. The Samsung ID is SVE-2016-6560 (October 2016).
CVE-2017-0193HIGHCVSS 7.8EG 7.8
2017-06-15
Windows Hyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to gain elevated pr…
CVE-2017-0622HIGHCVSS 7.0EG 7.0
2017-05-12
An elevation of privilege vulnerability in the Goodix touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromis…
CVE-2017-0759HIGHCVSS 7.8EG 7.8
2017-09-08
A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36715268.
CVE-2017-0760HIGHCVSS 7.8EG 7.8
2017-09-08
A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37237396.
CVE-2017-0762HIGHCVSS 7.8EG 7.8
2017-09-08
A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62214264.
CVE-2017-0904HIGHCVSS 8.1EG 8.1
2017-11-13
The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private ne…
CVE-2017-11140MEDIUMCVSS 5.5EG 5.5
2017-07-10
The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which allows remote attackers to cause a denial of service (resource consumption) via crafted JPEG files.
CVE-2017-11472HIGHCVSS 7.1EG 7.1
2017-07-20
The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory …
CVE-2017-13199HIGHCVSS 7.5EG 7.5
2018-01-12
In Bitmap.ccp if Bitmap.nativeCreate fails an out of memory exception is not thrown leading to a java.io.IOException later on. This could lead to a remote denial of service of a critical system process with no additional execution privileg…
CVE-2017-14178HIGHCVSS 7.5EG 7.5
2018-02-02
In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions.
CVE-2017-17044MEDIUMCVSS 6.5EG 6.5
2017-11-28
An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to cause a denial of service (infinite loop and host OS hang) by leveraging the mishandling of Populate on Demand (PoD) errors.
CVE-2017-17172HIGHCVSS 7.3EG 7.3
2018-06-14
Huawei smart phones LYO-L21 with software LYO-L21C479B107, LYO-L21C479B107 have a privilege escalation vulnerability. An authenticated, local attacker can crafts malformed packets after tricking a user to install a malicious application an…
CVE-2017-18659MEDIUMCVSS 5.3EG 5.3
2020-04-07
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software. Attackers can crash system processes via a broadcast to AdaptiveDisplayColorService. The Samsung ID is SVE-2017-8290 (July 2017).
CVE-2017-18663HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with N(7.x) software. Because of missing Intent exception handling, system_server can have a NullPointerException with a crash of a system process. The Samsung IDs are SVE-2017-9122, SVE-20…
CVE-2017-18670HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. android.intent.action.SIOP_LEVEL_CHANGED allows a serializable intent reboot. The Samsung ID is SVE-2017-8363 (May 2017).
CVE-2017-18671HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.x) software. Intents related to Wi-Fi have incorrect exception handling, leading to a crash of system processes. The Samsung ID is SVE-2017-8389 (May 2017).
CVE-2017-18672MEDIUMCVSS 5.5EG 5.5
2020-04-07
An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.x) software. Because of incorrect exception handling for Intents, a local attacker can force a reboot within framework.jar. The Samsung ID is SVE-2017-8390 …
CVE-2017-18678HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software. An attacker can crash system processes via a Serializable object because of missing exception handling. The Samsung IDs are SVE-2017-8…
CVE-2017-18682HIGHCVSS 7.5EG 7.5
2020-04-07
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. Because of incorrect exception handling and an unprotected intent, AudioService can cause a system crash, The Samsung IDs are SVE-2017…
CVE-2017-2877CRITICALCVSS 9.8EG 9.8
2018-09-19
A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted request on port 10001 could allow an attacker to reset the user accounts to facto…
CVE-2017-3832HIGHCVSS 7.5EG 7.5
2017-04-06
A vulnerability in the web management interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to…
CVE-2017-3887MEDIUMCVSS 5.9EG 5.9
2017-04-07
A vulnerability in the detection engine that handles Secure Sockets Layer (SSL) packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition because the Snort proc…
CVE-2017-5638CRITICALCVSS 9.8EG 9.8⚠ KEV
2017-03-11
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary com…
CVE-2017-5664HIGHCVSS 7.5EG 7.5
2017-06-06
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that …
CVE-2017-6628MEDIUMCVSS 6.8EG 6.8
2017-05-03
A vulnerability in SMART-SSL Accelerator functionality for Cisco Wide Area Application Services (WAAS) 6.2.1, 6.2.1a, and 6.2.3a could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition where the WAN opt…
CVE-2017-6678HIGHCVSS 7.5EG 7.5
2017-06-26
A vulnerability in the ingress UDP packet processing functionality of Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software 19.2 through 21.0 could allow an unauthenticated, remote attacker to cause both control function (CF…
CVE-2017-7496HIGHCVSS 7.0EG 7.0
2017-06-26
fedora-arm-installer up to and including 1.99.16 is vulnerable to local privilege escalation due to lack of checking the error condition of mount operation failure on unsafely created temporary directories.
CVE-2017-7518HIGHCVSS 5.5EG 7.8
2018-07-30
A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack…
CVE-2017-9657MEDIUMCVSS 6.5EG 6.5
2018-04-30
Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the central monitoring station is possible. In this state, the central monitoring station can indicate the MX…
CVE-2017-9658MEDIUMCVSS 6.5EG 6.5
2018-04-30
Certain 802.11 network management messages have been determined to invoke wireless access point blacklisting security defenses when not required, which can necessitate intervention by hospital staff to reset the device and reestablish a ne…
CVE-2018-0155CRITICALCVSS 8.6EG 9.0⚠ KEV
2018-03-28
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the…
CVE-2018-0272MEDIUMCVSS 5.9EG 5.9
2018-04-19
A vulnerability in the Secure Sockets Layer (SSL) Engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper error handling w…
CVE-2018-0286MEDIUMCVSS 5.3EG 5.3
2018-05-02
A vulnerability in the netconf interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on affected system. The vulnerability is due to improper handling of malformed r…
CVE-2018-0316HIGHCVSS 7.5EG 7.5
2018-06-07
A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 6800, 7800, and 8800 Series Phones with Multiplatform Firmware could allow an unauthenticated, remote attacker to cause an affected phon…
CVE-2018-0934HIGHCVSS 7.5EG 8.5
2018-03-14
ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulner…
CVE-2018-11921HIGHCVSS 7.8EG 7.8
2018-11-28
Failure condition is not handled properly and the correct error code is not returned. It could cause unintended SUI behavior and create unintended SUI display in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9…
CVE-2018-1269MEDIUMCVSS 6.5EG 6.5
2018-06-06
Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not handle errors thrown while constructing certain http requests. A remote authentica…
CVE-2018-1677MEDIUMCVSS 5.1EG 5.5
2018-12-20
IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of service, caused by the improper handling of full file system. A local attacker could exploit this vulnerability to cause a …

Map vulnerabilities like CWE-755 to your infrastructure

EchelonGraph correlates every CVE — across CWE-755 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →