Weaknesses of type CWE-120

3,163 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2025-12236HIGHTenda CH22 DhcpListClient fromDhcpListClient buffer overflowEPSS 3.2%CVE-2022-36279HIGHA stack-based buffer overflow vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A sEPSS 3.2%CVE-2026-2911HIGHTenda FH451 GstDhcpSetSer buffer overflowEPSS 3.1%CVE-2020-7374MEDIUMDocumalis Free PDF Editor / Free PDF Scanner Stack Based Buffer OverflowEPSS 3.1%CVE-2017-2633MEDIUMAn out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while EPSS 3.0%CVE-2021-1405HIGHClam AntiVirus (ClamAV) PDF Parser Denial of Service VulnerabilityEPSS 3.0%CVE-2024-46215MEDIUMA vulnerability was discovered in KM08-708H-v1.1, There is a buffer overflow in the sub_445BDC() function within the /usr/sbin/goahead progrEPSS 3.0%CVE-2024-9570HIGHD-Link DIR-619L B1 formEasySetTimezone buffer overflowEPSS 2.9%CVE-2021-30983HIGHA buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. An application may be EPSS 2.9%KEVCVE-2025-64053HIGHA Buffer overflow vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrarEPSS 2.9%CVE-2020-10070CRITICALMQTT buffer overflow on receive bufferEPSS 2.9%CVE-2025-4452HIGHD-Link DIR-619L formSetWizard2 buffer overflowEPSS 2.9%CVE-2025-4451HIGHD-Link DIR-619L formSetWAN_Wizard52 buffer overflowEPSS 2.9%CVE-2025-4448HIGHD-Link DIR-619L formEasySetupWizard buffer overflowEPSS 2.9%CVE-2025-4450HIGHD-Link DIR-619L formSetEasy_Wizard buffer overflowEPSS 2.9%CVE-2025-4449HIGHD-Link DIR-619L formEasySetupWizard3 buffer overflowEPSS 2.9%CVE-2022-32788CRITICALA buffer overflow was addressed with improved bounds checking. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOEPSS 2.9%CVE-2022-22723—A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and EPSS 2.8%CVE-2015-6458—Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMEPSS 2.8%CVE-2022-22725—A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and EPSS 2.8%