Weaknesses of type CWE-120

3,163 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2022-40985HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.6%CVE-2021-33226CRITICALBuffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/moEPSS 1.6%CVE-2022-31019HIGHDoS Vulnerability in URLEncodedFormDecoder in VaporEPSS 1.6%CVE-2023-46012CRITICALBuffer Overflow vulnerability LINKSYS EA7500 3.0.1.207964 allows a remote attacker to execute arbitrary code via an HTTP request to the IGD EPSS 1.6%CVE-2025-4871MEDIUMPCMan FTP Server REST Command buffer overflowEPSS 1.6%CVE-2019-11851CRITICALThe ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows rEPSS 1.6%CVE-2021-33537HIGHWEIDMUELLER: WLAN devices affected by Remote Code Execution (RCE) vulnerabilityEPSS 1.6%CVE-2022-32504CRITICALAn issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service EPSS 1.6%CVE-2021-20236—A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the EPSS 1.6%CVE-2025-69259HIGHA message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service EPSS 1.6%CVE-2025-69260HIGHA message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service conditionEPSS 1.6%CVE-2022-22683CRITICALBuffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-EPSS 1.6%CVE-2023-21517HIGHHeap out-of-bound write vulnerability in Exynos baseband prior to SMR Jun-2023 Release 1 allows remote attacker to execute arbitrary code.EPSS 1.6%CVE-2025-8169HIGHD-Link DIR-513 HTTP POST Request formSetWanPPTPpath formSetWanPPTPcallback buffer overflowEPSS 1.6%CVE-2021-21939CRITICALA heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can EPSS 1.6%CVE-2025-4149HIGHNetgear EX6200 sub_54014 buffer overflowEPSS 1.6%CVE-2025-4148HIGHNetgear EX6200 sub_503FC buffer overflowEPSS 1.6%CVE-2024-9535HIGHD-Link DIR-605L formEasySetupWWConfig buffer overflowEPSS 1.6%CVE-2024-9786HIGHD-Link DIR-619L B1 formSetLog buffer overflowEPSS 1.6%CVE-2022-39274HIGHBuffer Overflow in `ProcessRadioRxDone` in LoRaMac-nodeEPSS 1.6%