Weaknesses of type CWE-120

3,163 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2026-7248CRITICALD-Link DI-8100 CGI Endpoint tgfile.htm tgfile_htm buffer overflowEPSS 2.2%CVE-2025-4347HIGHD-Link DIR-600L formWlSiteSurvey buffer overflowEPSS 2.2%CVE-2020-8261—A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.EPSS 2.2%CVE-2022-39344CRITICALAzure RTOS USBX vulnerable to buffer overflow EPSS 2.1%CVE-2024-7832HIGHD-Link DNS-1550-04 photocenter_mgr.cgi cgi_get_fullscreen_photos buffer overflowEPSS 2.1%CVE-2023-45614CRITICALThere are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending EPSS 2.1%CVE-2023-22779CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22786CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2022-29189MEDIUMBuffer for inbound DTLS fragments has no limitEPSS 2.1%CVE-2022-24754HIGHBuffer overflow in pjsipEPSS 2.1%CVE-2023-3346CRITICALDenial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC SeriesEPSS 2.1%CVE-2022-31414HIGHD-Link DIR-1960 firmware DIR-1960_A1_1.11 was discovered to contain a buffer overflow via srtcat in prog.cgi. This vulnerability allowed attEPSS 2.1%CVE-2023-22780CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22781CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22784CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22783CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22785CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22782CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2022-35927HIGHUnverified DIO prefix info lengths in RPL-Classic in Contiki-NGEPSS 2.1%CVE-2025-55847HIGHWavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises becauseEPSS 2.0%