Weaknesses of type CWE-119

3,514 results

Corrupção de memória genérica

Fraqueza ampla que descreve qualquer escrita ou leitura inadequada de dados na memória do programa, violando os limites esperados de um buffer, estrutura ou alocação. O risco é grave: pode levar a travamento, execução de código arbitrário ou exposição de dados sensíveis, dependendo de como o atacante explora o acesso descontrolado.

Example

Um programa C lê mais bytes de um array do que deveria (estouro de buffer clássico), ou escreve em endereço de memória inválido após liberar um ponteiro. Em ambos os casos, dados adjacentes são sobrescrevidos ou corrompidos, causando comportamento impredizível ou crash.

How to mitigate

Use verificações de limites antes de qualquer acesso indexado; prefira linguagens com gerenciamento automático de memória (Go, Rust, Python) quando possível; em C/C++, empregue ferramentas como AddressSanitizer em testes e ASLR+DEP/NX em produção para dificultar exploração. Revise ponteiros e aritmética de buffer em code review.

CVE-2025-5623CRITICALD-Link DIR-816 qosClassifier stack-based overflowEPSS 19.5%CVE-2024-0088MEDIUMCVEEPSS 18.9%CVE-2017-0022MEDIUMMicrosoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 EPSS 18.1%KEVCVE-2025-1340HIGHTOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflowEPSS 16.7%CVE-2025-5548MEDIUMFreeFloat FTP Server NOOP Command buffer overflowEPSS 15.9%CVE-2025-8184HIGHD-Link DIR-513 HTTP POST Request formSetWanL2TPtriggers formSetWanL2TPcallback stack-based overflowEPSS 15.4%CVE-2014-3478MEDIUMBuffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.EPSS 15.2%CVE-2017-3807—A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases 9.0-EPSS 14.8%CVE-2018-0151CRITICALA vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, reEPSS 14.2%KEVCVE-2025-7088HIGHBelkin F9K1122 webs formPPPoESetup stack-based overflowEPSS 14.1%CVE-2018-4404HIGHIn iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improved memory handling.EPSS 14.0%CVE-2025-7087HIGHBelkin F9K1122 webs formL2TPSetup stack-based overflowEPSS 13.7%CVE-2017-16368HIGHAn issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.3035EPSS 13.2%CVE-2025-8017HIGHTenda AC7 httpd setMacFilterCfg formSetMacFilterCfg stack-based overflowEPSS 13.2%CVE-2025-3538HIGHD-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflowEPSS 13.2%CVE-2025-3785HIGHD-Link DWR-M961 Authorization Interface formStaticDHCP stack-based overflowEPSS 12.8%CVE-2025-3820HIGHTenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflowEPSS 12.7%CVE-2025-5527HIGHTenda RX3 SetStaticRouteCfg save_staticroute_data stack-based overflowEPSS 12.7%CVE-2025-5905HIGHTOTOLINK T10 POST Request cstecgi.cgi setWiFiRepeaterCfg buffer overflowEPSS 12.4%CVE-2025-8180HIGHTenda CH22 deleteUserName formdeleteUserName buffer overflowEPSS 12.3%