Weaknesses of type CWE-119

3,263 results

Corrupção de memória genérica

Fraqueza ampla que descreve qualquer escrita ou leitura inadequada de dados na memória do programa, violando os limites esperados de um buffer, estrutura ou alocação. O risco é grave: pode levar a travamento, execução de código arbitrário ou exposição de dados sensíveis, dependendo de como o atacante explora o acesso descontrolado.

Example

Um programa C lê mais bytes de um array do que deveria (estouro de buffer clássico), ou escreve em endereço de memória inválido após liberar um ponteiro. Em ambos os casos, dados adjacentes são sobrescrevidos ou corrompidos, causando comportamento impredizível ou crash.

How to mitigate

Use verificações de limites antes de qualquer acesso indexado; prefira linguagens com gerenciamento automático de memória (Go, Rust, Python) quando possível; em C/C++, empregue ferramentas como AddressSanitizer em testes e ASLR+DEP/NX em produção para dificultar exploração. Revise ponteiros e aritmética de buffer em code review.

CVE-2018-0292—A vulnerability in the Internet Group Management Protocol (IGMP) Snooping feature of Cisco NX-OS Software could allow an unauthenticated, adEPSS 1.6%CVE-2025-4150HIGHNetgear EX6200 sub_54340 buffer overflowEPSS 1.5%CVE-2025-31277HIGHThe issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOEPSS 1.5%KEVCVE-2021-40117HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service VulnerabilityEPSS 1.5%CVE-2021-3942CRITICALCertain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use of EPSS 1.5%CVE-2021-31883HIGHA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.5%CVE-2021-31882MEDIUMA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.5%CVE-2026-7853CRITICALD-Link DI-8100 HTTP auto_reboot.asp sprintf buffer overflowEPSS 1.5%CVE-2025-9938HIGHD-Link DI-8400 yyxz.asp yyxz_dlink_asp stack-based overflowEPSS 1.5%CVE-2021-31493HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.5%CVE-2019-1926HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.5%CVE-2024-23213HIGHThe issue was addressed with improved memory handling. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOSEPSS 1.5%CVE-2025-7911HIGHD-Link DI-8100 jhttpd upnp_ctrl.asp sprintf stack-based overflowEPSS 1.5%CVE-2014-0779—Schneider Electric StruxureWare SCADA Expert ClearSCADA Improper Restriction of Operations within the Bounds of a Memory BufferEPSS 1.5%CVE-2019-1640HIGHCisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesEPSS 1.5%CVE-2019-1637HIGHCisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesEPSS 1.5%CVE-2019-1639HIGHCisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesEPSS 1.5%CVE-2019-1638HIGHCisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesEPSS 1.5%CVE-2023-33975CRITICALRIOT-OS vulnerable to Out of Bounds Write in _rbuf_addEPSS 1.5%CVE-2023-28391CRITICALA memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafEPSS 1.5%