Weaknesses of type CWE-119

3,263 results

Corrupção de memória genérica

Fraqueza ampla que descreve qualquer escrita ou leitura inadequada de dados na memória do programa, violando os limites esperados de um buffer, estrutura ou alocação. O risco é grave: pode levar a travamento, execução de código arbitrário ou exposição de dados sensíveis, dependendo de como o atacante explora o acesso descontrolado.

Example

Um programa C lê mais bytes de um array do que deveria (estouro de buffer clássico), ou escreve em endereço de memória inválido após liberar um ponteiro. Em ambos os casos, dados adjacentes são sobrescrevidos ou corrompidos, causando comportamento impredizível ou crash.

How to mitigate

Use verificações de limites antes de qualquer acesso indexado; prefira linguagens com gerenciamento automático de memória (Go, Rust, Python) quando possível; em C/C++, empregue ferramentas como AddressSanitizer em testes e ASLR+DEP/NX em produção para dificultar exploração. Revise ponteiros e aritmética de buffer em code review.

CVE-2025-5624CRITICALD-Link DIR-816 QoSPortSetup stack-based overflowEPSS 2.5%CVE-2020-7550—A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version EPSS 2.5%CVE-2020-7554—A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version EPSS 2.5%CVE-2017-3808—A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager (Cisco Unified CM) cEPSS 2.5%CVE-2026-5204HIGHTenda CH22 Parameter webtypelibrary formWebTypeLibrary stack-based overflowEPSS 2.5%CVE-2025-13188CRITICALD-Link DIR-816L authentication.cgi authenticationcgi_main stack-based overflowEPSS 2.4%CVE-2021-21951CRITICALAn out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker EufEPSS 2.4%CVE-2021-21950CRITICALAn out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker EufEPSS 2.4%CVE-2021-22714—A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION7400, PM8000 and IONEPSS 2.4%CVE-2018-14320—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is requEPSS 2.4%CVE-2018-0204—A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to creaEPSS 2.3%CVE-2017-6791—A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attacEPSS 2.3%CVE-2017-12270—A vulnerability in the gRPC code of Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series Routers could allow an unauEPSS 2.3%CVE-2017-12259—A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA51x Series IP Phones couEPSS 2.3%CVE-2017-12260—A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x EPSS 2.3%CVE-2017-12293—A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.EPSS 2.3%CVE-2018-0132—A vulnerability in the forwarding information base (FIB) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to caEPSS 2.3%CVE-2019-11926—Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memoryEPSS 2.3%CVE-2021-1433HIGHCisco IOS XE SD-WAN Software vDaemon Buffer Overflow VulnerabilityEPSS 2.3%CVE-2018-8872—In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within theEPSS 2.2%