Weaknesses of type CWE-120

3,164 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2022-26335—A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE XEPSS 1.4%CVE-2026-7069HIGHD-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer overflowEPSS 1.4%CVE-2024-7490CRITICALRemote Code Execution in Advanced Software Framework DHCP serverEPSS 1.4%CVE-2024-9515HIGHD-Link DIR-605L formSetQoS buffer overflowEPSS 1.4%CVE-2024-9556HIGHD-Link DIR-605L formSetEnableWizard buffer overflowEPSS 1.4%CVE-2024-9553HIGHD-Link DIR-605L formdumpeasysetup buffer overflowEPSS 1.4%CVE-2024-9561HIGHD-Link DIR-605L formSetWAN_Wizard52 buffer overflowEPSS 1.4%CVE-2024-9555HIGHD-Link DIR-605L formSetEasy_Wizard buffer overflowEPSS 1.4%CVE-2024-9562HIGHD-Link DIR-605L formSetWizard2 buffer overflowEPSS 1.4%CVE-2021-33975CRITICALBuffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows attacker to escalate privileges.EPSS 1.4%CVE-2021-34979HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.78_1.0.1 rouEPSS 1.4%CVE-2022-40993HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2022-40991HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2022-40987HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2022-40988HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2022-40994HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2022-40995HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2022-40989HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2022-40992HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2022-40999HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%