Weaknesses of type CWE-120

3,246 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2025-24237CRITICALA buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS SequoiaEPSS 1.6%CVE-2023-46012CRITICALBuffer Overflow vulnerability LINKSYS EA7500 3.0.1.207964 allows a remote attacker to execute arbitrary code via an HTTP request to the IGD EPSS 1.6%CVE-2022-34756HIGHA CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs EPSS 1.6%CVE-2023-21517HIGHHeap out-of-bound write vulnerability in Exynos baseband prior to SMR Jun-2023 Release 1 allows remote attacker to execute arbitrary code.EPSS 1.6%CVE-2022-32504CRITICALAn issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service EPSS 1.6%CVE-2021-33537HIGHWEIDMUELLER: WLAN devices affected by Remote Code Execution (RCE) vulnerabilityEPSS 1.6%CVE-2021-21901CRITICALA stack-based buffer overflow vulnerability exists in the CMA check_udp_crc function of Garrett Metal Detectors’ iC Module CMA Version 5.0. EPSS 1.6%CVE-2021-21939CRITICALA heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can EPSS 1.6%CVE-2025-4346HIGHD-Link DIR-600L formSetWAN_Wizard534 buffer overflowEPSS 1.6%CVE-2025-4345HIGHD-Link DIR-600L formSetLog buffer overflowEPSS 1.6%CVE-2025-4344HIGHD-Link DIR-600L formLogin buffer overflowEPSS 1.6%CVE-2024-9535HIGHD-Link DIR-605L formEasySetupWWConfig buffer overflowEPSS 1.6%CVE-2024-9786HIGHD-Link DIR-619L B1 formSetLog buffer overflowEPSS 1.6%CVE-2024-39294CRITICALA buffer overflow vulnerability exists in the adm.cgi set_wzdgw4G() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted EPSS 1.6%CVE-2024-39299CRITICALA buffer overflow vulnerability exists in the qos.cgi qos_sta_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craEPSS 1.6%CVE-2023-20024HIGHCisco Small Business Series Switches Buffer Overflow VulnerabilitiesEPSS 1.6%CVE-2025-69260HIGHA message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service conditionEPSS 1.6%CVE-2025-69259HIGHA message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service EPSS 1.6%CVE-2024-4020HIGHTenda FH1206 addressNat fromAddressNat buffer overflowEPSS 1.6%CVE-2024-9911HIGHD-Link DIR-619L B1 formSetPortTr buffer overflowEPSS 1.6%