CWE-755— Improper Handling of Exceptional Conditions

533 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-755page 6 of 11

CVE-2021-30289HIGHCVSS 7.8EG 7.8
2022-01-03
Possible buffer overflow due to lack of range check while processing a DIAG command for COEX management in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music…
CVE-2021-3053HIGHCVSS 7.5EG 7.5
2021-09-08
An improper handling of exceptional conditions vulnerability exists in the Palo Alto Networks PAN-OS dataplane that enables an unauthenticated network-based attacker to send specifically crafted traffic through the firewall that causes the…
CVE-2021-3063HIGHCVSS 7.5EG 7.5
2021-11-10
An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalPr…
CVE-2021-30639HIGHCVSS 7.5EG 7.5
2021-07-12
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request ob…
CVE-2021-3127HIGHCVSS 7.5EG 7.5
2021-03-16
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
CVE-2021-31353HIGHCVSS 7.5EG 7.5
2021-10-19
An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an attacker to inject a specific BGP update, causing the routing protocol daemon (RPD) to crash and restart, leading to a…
CVE-2021-31361MEDIUMCVSS 5.3EG 5.3
2021-10-19
An Improper Check for Unusual or Exceptional Conditions vulnerability combined with Improper Handling of Exceptional Conditions in Juniper Networks Junos OS on QFX Series and PTX Series allows an unauthenticated network based attacker to c…
CVE-2021-31701HIGHCVSS 7.5EG 7.5
2021-06-06
Mintty before 3.4.7 mishandles Bracketed Paste Mode.
CVE-2021-32066HIGHCVSS 7.4EG 7.4
2021-08-01
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the T…
CVE-2021-32999HIGHCVSS 7.5EG 7.5
2021-09-23
Improper handling of exceptional conditions in SuiteLink server while processing command 0x01
CVE-2021-33477HIGHCVSS 8.8EG 8.8
2021-05-20
rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.
CVE-2021-33486HIGHCVSS 7.5EG 7.5
2021-08-03
All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions.
CVE-2021-33795MEDIUMCVSS 5.5EG 5.5
2021-07-09
Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document owner, and signature author are mishandled.
CVE-2021-34549HIGHCVSS 7.5EG 7.5
2021-06-29
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency.
CVE-2021-34593HIGHCVSS 7.5EG 7.5
2021-10-26
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or f…
CVE-2021-34716MEDIUMCVSS 6.7EG 6.7
2021-08-18
A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating sy…
CVE-2021-34781HIGHCVSS 8.6EG 8.6
2021-10-27
A vulnerability in the processing of SSH connections for multi-instance deployments of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affect…
CVE-2021-34787MEDIUMCVSS 5.3EG 5.3
2021-10-27
A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass s…
CVE-2021-36128CRITICALCVSS 9.8EG 9.8
2021-07-02
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Autoblocks for CentralAuth-issued suppression blocks are not properly implemented.
CVE-2021-36282LOWCVSS 2.5EG 3.3
2021-08-16
Dell EMC PowerScale OneFS versions 8.2.x - 9.1.0.x contain a use of uninitialized resource vulnerability. This can potentially allow an authenticated user with ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_LOGIN_SSH privileges to gain access up to 24…
CVE-2021-37052HIGHCVSS 7.5EG 7.5
2021-12-08
There is an Exception log vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause address information leakage.
CVE-2021-37078HIGHCVSS 7.5EG 7.5
2021-12-07
There is a Uncaught Exception vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to remote Denial of Service.
CVE-2021-37118MEDIUMCVSS 5.3EG 5.3
2022-01-03
The HwNearbyMain module has a Improper Handling of Exceptional Conditions vulnerability.Successful exploitation of this vulnerability may lead to message leak.
CVE-2021-37175MEDIUMCVSS 5.3EG 5.3
2021-09-14
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM RO…
CVE-2021-37786MEDIUMCVSS 4.6EG 4.6
2021-09-27
Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exceptional conditions. This affects COVID Certificate App IOS 2.2.0 and below affected, patch in progress a…
CVE-2021-37851HIGHCVSS 7.3EG 7.8
2022-05-11
Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious code with higher privileges. This issue affects: ESET, spol. s r.o. ESET NOD32 Ant…
CVE-2021-38003HIGHCVSS 8.8EG 8.8⚠ KEV
2021-11-23
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-38363HIGHCVSS 7.5EG 7.5
2023-04-20
An issue was discovered in ONOS 2.5.1. In IntentManager, the install-requested intent (which causes an exception) remains in pendingMap (in memory) forever. Deletion is possible neither by a user nor by the intermittent Intent Cleanup proc…
CVE-2021-38384CRITICALCVSS 9.8EG 9.8
2021-08-10
Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 20…
CVE-2021-39131HIGHCVSS 7.5EG 7.5
2021-08-17
ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing…
CVE-2021-39157HIGHCVSS 7.5EG 7.5
2021-08-24
detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in [detect-chara…
CVE-2021-39187HIGHCVSS 7.5EG 7.5
2021-09-02
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due t…
CVE-2021-39242HIGHCVSS 7.5EG 7.5
2021-08-17
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled.
CVE-2021-39659MEDIUMCVSS 5.5EG 5.5
2022-01-14
In sortSimPhoneAccountsForEmergency of CreateConnectionProcessor.java, there is a possible prevention of access to emergency calling due to an unhandled exception. In rare instances, this could lead to local denial of service with User exe…
CVE-2021-40391CRITICALCVSS 9.8EG 9.8
2021-11-19
An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code exec…
CVE-2021-40402HIGHCVSS 7.5EG 7.5
2022-04-14
An out-of-bounds read vulnerability exists in the RS-274X aperture macro multiple outline primitives functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.7.1 and 2.8.0. A specially-crafted Gerber file can lead to info…
CVE-2021-4105CRITICALCVSS 9.8EG 9.8
2023-02-24
Improper Handling of Parameters vulnerability in BG-TEK COSLAT Firewall allows Remote Code Inclusion. This issue affects COSLAT Firewall: from 5.24.0.R.20180630 before 5.24.0.R.20210727.
CVE-2021-42141CRITICALCVSS 9.8EG 9.8
2024-01-22
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with different epoch numbers in the packets Client_Hello, Client_key_exchange, and Change_cipher_spec, which may cause denial of serv…
CVE-2021-42142CRITICALCVSS 9.8EG 9.8
2024-01-23
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. This vulnerability allows remote attackers to cause a denial of service and false-positive packet d…
CVE-2021-42145HIGHCVSS 7.5EG 7.5
2024-01-24
An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cause a denial of service.
CVE-2021-42146HIGHCVSS 7.5EG 7.5
2024-01-24
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulner…
CVE-2021-43173HIGHCVSS 7.5EG 7.5
2021-11-09
In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. Wh…
CVE-2021-43272CRITICALCVSS 9.8EG 9.8
2021-11-14
An improper handling of exceptional conditions vulnerability exists in Open Design Alliance ODA Viewer sample before 2022.11. ODA Viewer continues to process invalid or malicious DWF files instead of stopping upon an exception. An attacker…
CVE-2021-43827MEDIUMCVSS 4.3EG 4.3
2021-12-14
discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tags (e.g. `<a>^[footnote]</a>`, the resulting rendered HTML would include a nested `<a>`, which is str…
CVE-2021-43979MEDIUMCVSS 5.3EG 5.3
2021-11-17
Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication,…
CVE-2021-46828HIGHCVSS 7.5EG 7.5
2022-07-20
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connect…
CVE-2021-46928MEDIUMCVSS 5.5EG 5.5
2024-02-27
In the Linux kernel, the following vulnerability has been resolved: parisc: Clear stale IIR value on instruction access rights trap When a trap 7 (Instruction access rights) occurs, this means the CPU couldn't execute an instruction due …
CVE-2022-0016HIGHCVSS 7.4EG 7.4
2022-02-10
An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticat…
CVE-2022-0023MEDIUMCVSS 5.9EG 5.9
2022-04-13
An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle (MITM) to send specifically crafted traffic to the firewall that causes…
CVE-2022-0264MEDIUMCVSS 5.5EG 5.5
2022-02-04
A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use…

Map vulnerabilities like CWE-755 to your infrastructure

EchelonGraph correlates every CVE — across CWE-755 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →