Weaknesses of type CWE-119

3,265 results

Corrupção de memória genérica

Fraqueza ampla que descreve qualquer escrita ou leitura inadequada de dados na memória do programa, violando os limites esperados de um buffer, estrutura ou alocação. O risco é grave: pode levar a travamento, execução de código arbitrário ou exposição de dados sensíveis, dependendo de como o atacante explora o acesso descontrolado.

Example

Um programa C lê mais bytes de um array do que deveria (estouro de buffer clássico), ou escreve em endereço de memória inválido após liberar um ponteiro. Em ambos os casos, dados adjacentes são sobrescrevidos ou corrompidos, causando comportamento impredizível ou crash.

How to mitigate

Use verificações de limites antes de qualquer acesso indexado; prefira linguagens com gerenciamento automático de memória (Go, Rust, Python) quando possível; em C/C++, empregue ferramentas como AddressSanitizer em testes e ASLR+DEP/NX em produção para dificultar exploração. Revise ponteiros e aritmética de buffer em code review.

CVE-2018-4233HIGHAn issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on WindoEPSS 53.3%CVE-2011-1889CRITICALThe NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execuEPSS 49.0%KEVCVE-2017-6737HIGHA vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to rEPSS 45.2%KEVCVE-2025-68615CRITICALNet-SNMP snmptrapd crashEPSS 42.4%CVE-2020-3331CRITICALCisco RV110W and RV215W Series Routers Arbitrary Code Execution VulnerabilityEPSS 41.7%CVE-2013-3660HIGHThe EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, EPSS 39.3%KEVCVE-2014-3931CRITICALfastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruEPSS 29.0%KEVCVE-2012-6438HIGHRockwell Automation ControlLogix PLC Improper Input ValidationEPSS 27.4%CVE-2017-3823—An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on MEPSS 27.2%CVE-2012-6436HIGHRockwell Automation ControlLogix PLC Improper Input ValidationEPSS 27.1%CVE-2019-1913CRITICALCisco Small Business 220 Series Smart Switches Remote Code Execution VulnerabilitiesEPSS 25.9%CVE-2025-14174HIGHOut of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memoEPSS 22.3%KEVCVE-2023-3824CRITICALBuffer overflow and overread in phar_dir_read()EPSS 21.8%CVE-2017-6742HIGHA vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to rEPSS 21.4%KEVCVE-2016-0778HIGHThe (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certaEPSS 20.9%CVE-2025-7775CRITICALMemory overflow vulnerability leading to Remote Code Execution and/or Denial of ServiceEPSS 19.6%KEVCVE-2024-0088MEDIUMCVEEPSS 18.9%CVE-2025-31200CRITICALA memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15EPSS 18.8%KEVCVE-2025-5623CRITICALD-Link DIR-816 qosClassifier stack-based overflowEPSS 18.5%CVE-2025-7206CRITICALD-Link DIR-825 httpd switch_language.cgi sub_410DDC stack-based overflowEPSS 18.4%