Weaknesses of type CWE-120

3,164 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2022-40994HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2022-40999HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2025-5909HIGHTOTOLINK EX1200T HTTP POST Request formReflashClientTbl buffer overflowEPSS 1.4%CVE-2024-7582HIGHTenda i22 apPortalAccessCodeAuth formApPortalAccessCodeAuth buffer overflowEPSS 1.4%CVE-2024-7583HIGHTenda i22 apPortalOneKeyAuth formApPortalOneKeyAuth buffer overflowEPSS 1.4%CVE-2022-34823CRITICALBuffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SiEPSS 1.4%CVE-2023-26768HIGHBuffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the compileTranslationTabEPSS 1.4%CVE-2024-8579HIGHTOTOLINK AC1200 T8 cstecgi.cgi setWiFiRepeaterCfg buffer overflowEPSS 1.3%CVE-2024-7462HIGHTOTOLINK N350RT cstecgi.cgi setWizardCfg buffer overflowEPSS 1.3%CVE-2024-7465HIGHTOTOLINK CP450 cstecgi.cgi loginauth buffer overflowEPSS 1.3%CVE-2019-1010218—Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact isEPSS 1.3%CVE-2019-0160HIGHBuffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of EPSS 1.3%CVE-2024-39801CRITICALMultiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A speciallyEPSS 1.3%CVE-2022-28722CRITICALCertain HP Print Products are potentially vulnerable to Buffer Overflow.EPSS 1.3%CVE-2020-19695CRITICALBuffer Overflow found in Nginx NJS allows a remote attacker to execute arbitrary code via the njs_object_property parameter of the njs/njs_vEPSS 1.3%CVE-2021-38111HIGHThe DEF CON 27 badge allows remote attackers to exploit a buffer overflow by sending an oversized packet via the NFMI (Near Field Magnetic IEPSS 1.3%CVE-2024-7585HIGHTenda i22 apPortalAuth formApPortalWebAuth buffer overflowEPSS 1.3%CVE-2021-45345HIGHBuffer Overflow vulnerability found in En3rgy WebcamServer v.0.5.2 allows a remote attacker to cause a denial of service via the WebcamServeEPSS 1.3%CVE-2022-26649CRITICALA vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE EPSS 1.3%CVE-2026-2005HIGHPostgreSQL pgcrypto heap buffer overflow executes arbitrary codeEPSS 1.3%