CWE-755 · Input Validation and Logic
Improper Handling of Exceptional Conditions
441CVEs
3exploited
0with a public check
14likely (EPSS 10%+)
SortMost likely exploited
441 CVEs with CWE-755 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2017-5638In CISA KEVExploitedApache Struts 2 - Remote Command ExecutionApache Software Foundation · Apache Struts · CVSS 9.8 · 2017-03-11 | 9.8 | 100% | 2017-03-11 |
| CVE-2020-7247In CISA KEVExploitedOpenSMTPD 6.4.0-6.6.1 - Remote Code ExecutionOpenBSD · OpenSMTPD · CVSS 9.8 · 2020-01-29 | 9.8 | 99% | 2020-01-29 |
| CVE-2021-38003In CISA KEVExploitedInappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2021-11-23 | 8.8 | 39% | 2021-11-23 |
| CVE-2023-36933In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a me…Progress · Moveit Transfer · 2023-07-05 | – | 72% | 2023-07-05 |
| CVE-2018-0934ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in m…Microsoft Corporation · ChakraCore, Microsoft Edge · 2018-03-14 | – | 66% | 2018-03-14 |
| CVE-2019-14287In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invo…Sudo Project · Sudo · 2019-10-17 | – | 64% | 2019-10-17 |
| CVE-2019-12815An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE…Proftpd · Proftpd · 2019-07-19 | – | 57% | 2019-07-19 |
| CVE-2020-5807An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the FactoryTalk Diagnostics event log. The attacker can specify long…Rockwellautomation · Rockwell FactoryTalk Diagnostics · 2020-12-29 | – | 39% | 2020-12-29 |
| CVE-2024-21907Improper Handling of Exceptional Conditions in Newtonsoft.JsonNewtonsoft · Newtonsoft.Json · CVSS 7.5 · 2024-01-03 | 7.5 | 33% | 2024-01-03 |
| CVE-2019-6848A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication module (BMENOC0311, BMENOC0321) (see notif…Schneider-Electric · Modicon M580 CPU (BMEx58*) and Modicon M580 communication module (BMENOC0311, B… · 2019-10-29 | – | 32% | 2019-10-29 |
| CVE-2020-5801An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled exception in CFTLDManager::HandleRequest function in RnaDaSvr…Rockwellautomation · Rockwell FactoryTalk Linx · 2020-12-29 | – | 30% | 2020-12-29 |
| CVE-2019-6841A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon M340 (all firmware versions), and Modic…Schneider-Electric · Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA modules (see notificati… · 2019-10-29 | – | 24% | 2019-10-29 |
| CVE-2025-43864React Router allows a DoS via cache poisoning by forcing SPA moderemix-run · react-router · CVSS 7.5 · 2025-04-25 | 7.5 | 20% | 2025-04-25 |
| CVE-2019-14378ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.Libslirp Project · Libslirp · 2019-07-29 | – | 17% | 2019-07-29 |
| CVE-2017-5664The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request an…Apache Software Foundation · Apache Tomcat · 2017-06-06 | – | 17% | 2017-06-06 |
| CVE-2019-17195Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or…Connect2id · Nimbus Jose+jwt · 2019-10-15 | – | 11% | 2019-10-15 |
| CVE-2019-19924SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.Sqlite · Sqlite · 2019-12-24 | – | 11% | 2019-12-24 |
| CVE-2022-23121This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The speci…Netatalk · Netatalk · CVSS 9.8 · 2023-03-28 | 9.8 | 8.5% | 2023-03-28 |
| CVE-2018-8039It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'.…Apache Software Foundation · Apache CXF · 2018-07-02 | – | 8.2% | 2018-07-02 |
| CVE-2021-30639DoS after non-blocking IO errorApache Software Foundation · Apache Tomcat · 2021-07-12 | – | 6.9% | 2021-07-12 |
| CVE-2019-10742Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.axios · axios · 2019-05-07 | – | 6.1% | 2019-05-07 |
| CVE-2019-1376An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka 'SQL Server Management Studio Informat…Microsoft · SQL Server Management Studio · 2019-10-10 | – | 5.4% | 2019-10-10 |
| CVE-2019-1313An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka 'SQL Server Management Studio Informat…Microsoft · SQL Server Management Studio · 2019-10-10 | – | 5.3% | 2019-10-10 |
| CVE-2014-1943Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in…Fine Free File Project · Fine Free File · 2014-02-18 | – | 5.0% | 2014-02-18 |
| CVE-2020-7693Denial of Service (DoS)Sockjs Project · sockjs · CVSS 5.3 · 2020-07-09 | 5.3 | 5.0% | 2020-07-09 |
| CVE-2024-34750Apache Tomcat: HTTP/2 excess header handling DoSApache Software Foundation · Apache Tomcat · CVSS 7.5 · 2024-07-03 | 7.5 | 4.6% | 2024-07-03 |
| CVE-2019-10222A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid H…The Ceph Project · ceph · CVSS 7.5 · 2019-11-08 | 7.5 | 4.5% | 2019-11-08 |
| CVE-2006-5170pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server re…Fedoraproject · Fedora Core · 2006-10-04 | – | 4.1% | 2006-10-04 |
| CVE-2021-33477rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A respon…Eterm Project · Eterm · 2021-05-20 | – | 4.1% | 2021-05-20 |
| CVE-2020-2583Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.…Oracle Corporation · Java · CVSS 3.7 · 2020-01-15 | 3.7 | 4.0% | 2020-01-15 |
| CVE-2019-20218selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.Sqlite · Sqlite · 2020-01-02 | – | 3.7% | 2020-01-02 |
| CVE-2019-9735An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destinatio…Openstack · Neutron · 2019-03-13 | – | 3.7% | 2019-03-13 |
| CVE-2019-14431In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and possible Remote Cod…Matrixssl · Matrixssl · CVSS 9.8 · 2019-07-29 | 9.8 | 3.7% | 2019-07-29 |
| CVE-2021-43272An improper handling of exceptional conditions vulnerability exists in Open Design Alliance ODA Viewer sample before 2022.11. ODA Viewer continues to process invalid or malicious…Opendesign · Oda Viewer · 2021-11-14 | – | 3.6% | 2021-11-14 |
| CVE-2019-16866Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an a…Nlnetlabs · Unbound · 2019-10-03 | – | 3.5% | 2019-10-03 |
| CVE-2023-5824Squid: dos against http and httpsRed Hat · Red Hat Enterprise Linux 8 · CVSS 7.5 · 2023-11-03 | 7.5 | 3.3% | 2023-11-03 |
| CVE-2021-46828In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, le…Libtirpc Project · Libtirpc · CVSS 7.5 · 2022-07-20 | 7.5 | 3.2% | 2022-07-20 |
| CVE-2018-7849A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a possible Denial of Se…Schneider-Electric · Modicon M580 Modicon M340 Modicon Quantum Modicon Premium · 2019-05-22 | – | 3.2% | 2019-05-22 |
| CVE-2019-7846Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. Successful exploitation could lead to Information Disclosure in the…Adobe · Adobe Campaign · 2019-07-18 | – | 3.1% | 2019-07-18 |
| CVE-2021-32066An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, w…Ruby-Lang · Ruby · 2021-08-01 | – | 2.9% | 2021-08-01 |
| CVE-2021-28831decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip da…Busybox · Busybox · CVSS 7.5 · 2021-03-19 | 7.5 | 2.7% | 2021-03-19 |
| CVE-2021-34593CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-serviceCODESYS · CODESYS V2 · CVSS 7.5 · 2021-10-26 | 7.5 | 2.7% | 2021-10-26 |
| CVE-2020-24753A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Objec…Objective Open Cbor Run-Time Project · Objective Open Cbor Run-Time · 2020-09-17 | – | 2.6% | 2020-09-17 |
| CVE-2020-27543The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with…Restify-Paginate Project · Restify-Paginate · 2021-02-25 | – | 2.6% | 2021-02-25 |
| CVE-2020-15117Denial of Service in Synergysymless · synergy-core · CVSS 6.5 · 2020-07-15 | 6.5 | 2.5% | 2020-07-15 |
| CVE-2019-6256A Denial of Service issue was discovered in the LIVE555 Streaming Media libraries as used in Live555 Media Server 0.93. It can cause an RTSPServer crash in handleHTTPCmd_Tunneling…Live555 · Live555 Media Server · 2019-01-14 | – | 2.4% | 2019-01-14 |
| CVE-2018-19991VeryNginx 0.3.3 allows remote attackers to bypass the Web Application Firewall feature because there is no error handler (for get_uri_args or get_post_args) to block the API misus…Verynginx Project · Verynginx · 2018-12-10 | – | 2.3% | 2018-12-10 |
| CVE-2020-13410An issue was discovered in MoscaJS Aedes 0.42.0. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream.Aedes Project · Aedes · 2020-08-26 | – | 2.2% | 2020-08-26 |
| CVE-2019-6807A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of s…Schneider-Electric · Modicon M580 Modicon M340 Modicon Quantum Modicon Premium · 2019-05-22 | – | 2.2% | 2019-05-22 |
| CVE-2021-39242An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a m…Haproxy · Haproxy · 2021-08-17 | – | 2.2% | 2021-08-17 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.