CWE-391 - Unchecked Error Condition
- Abstraction:Base
- Structure:Simple
- Status:Incomplete
- Release Date:2006-07-19
- Latest Modification Date:2024-02-29
Weakness Name
Unchecked Error Condition
Description
[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
Common Consequences
Scope: Integrity, Other
Impact: Varies by Context, Unexpected State, Alter Execution Logic
Related Weaknesses
CWE-703Improper Check or Handling of Exceptional Conditions
CWE-754Improper Check for Unusual or Exceptional ConditionsMedium
Oracle denies breach after hacker claims theft of 6 million data records
Oracle Health breach compromises patient data at US hospitals
CrushFTP: Patch critical vulnerability ASAP! (CVE-2025-2825)
Russian Hackers Exploit CVE-2025-26633 via MSC EvilTwin to Deploy SilentPrism and DarkWisp
CosmicSting flaw impacts 75% of Adobe Commerce, Magento sites
New SuperBlack ransomware exploits Fortinet auth bypass flaws
Attackers are targeting CrushFTP vulnerability with public PoC (CVE-2025-2825)
RANsacked: Over 100 Security Flaws Found in LTE and 5G Network Implementations
CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability
CVE-2025-2783 Google Chromium Mojo Sandbox Escape Vulnerability
CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
CVE-2024-49035 Microsoft Partner Center Improper Access Control Vulnerability
CVE-2022-43769 Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
CVE-2024-40890 Zyxel DSL CPE OS Command Injection Vulnerability
CVE-2025-24983 Microsoft Windows Win32k Use-After-Free Vulnerability
CVE-2017-0148 Microsoft SMBv1 Server Remote Code Execution Vulnerability
CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
InformationalContent-Type Header Missing
InformationalServer Leaks its Webserver Application via "Server" HTTP Response Header Field
HighPath Traversal
MediumFormat String Error
CWE-1334 Unauthorized Error Injection Can Degrade Hardware Redundancy
CWE-1420 Exposure of Sensitive Information during Transient Execution
CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
CWE-214 Invocation of Process Using Visible Sensitive Information
CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
CWE-1386 Insecure Operation on Windows Junction / Mount Point