Weaknesses of type CWE-119

3,513 results

Corrupção de memória genérica

Fraqueza ampla que descreve qualquer escrita ou leitura inadequada de dados na memória do programa, violando os limites esperados de um buffer, estrutura ou alocação. O risco é grave: pode levar a travamento, execução de código arbitrário ou exposição de dados sensíveis, dependendo de como o atacante explora o acesso descontrolado.

Example

Um programa C lê mais bytes de um array do que deveria (estouro de buffer clássico), ou escreve em endereço de memória inválido após liberar um ponteiro. Em ambos os casos, dados adjacentes são sobrescrevidos ou corrompidos, causando comportamento impredizível ou crash.

How to mitigate

Use verificações de limites antes de qualquer acesso indexado; prefira linguagens com gerenciamento automático de memória (Go, Rust, Python) quando possível; em C/C++, empregue ferramentas como AddressSanitizer em testes e ASLR+DEP/NX em produção para dificultar exploração. Revise ponteiros e aritmética de buffer em code review.

CVE-2021-1433HIGHCisco IOS XE SD-WAN Software vDaemon Buffer Overflow VulnerabilityEPSS 2.3%CVE-2017-6791—A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attacEPSS 2.3%CVE-2017-12259—A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA51x Series IP Phones couEPSS 2.3%CVE-2017-12270—A vulnerability in the gRPC code of Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series Routers could allow an unauEPSS 2.3%CVE-2018-0132—A vulnerability in the forwarding information base (FIB) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to caEPSS 2.3%CVE-2017-12260—A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x EPSS 2.3%CVE-2017-12293—A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.EPSS 2.3%CVE-2019-11926—Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memoryEPSS 2.3%CVE-2017-9633HIGHAn Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMBEPSS 2.2%CVE-2023-3036HIGHOut of Bounds Slice index in cfnts leads to remote panicEPSS 2.2%CVE-2021-22710—A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA SystemEPSS 2.2%CVE-2021-22709—A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA SystemEPSS 2.2%CVE-2022-26776CRITICALThis issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. An attacker may be able to EPSS 2.2%CVE-2018-8872—In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within theEPSS 2.2%CVE-2025-8168HIGHD-Link DIR-513 formSetWanPPPoE websAspInit buffer overflowEPSS 2.2%CVE-2025-8169HIGHD-Link DIR-513 HTTP POST Request formSetWanPPTPpath formSetWanPPTPcallback buffer overflowEPSS 2.2%CVE-2021-34874HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.2%CVE-2019-17320—NetSarang XFTP Client 6.0149 and earlier version contains a buffer overflow vulnerability caused by improper boundary checks when copying fiEPSS 2.2%CVE-2020-27874HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent WeChat 7.0.18. User interaction isEPSS 2.2%CVE-2020-3451MEDIUMCisco Small Business RV340 Series Routers Command Injection and Remote Code Execution VulnerabilitiesEPSS 2.2%