Weaknesses of type CWE-120

3,164 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2022-45719CRITICALIP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the gotoUrl parameter in the formPortalAuth function.EPSS 1.1%CVE-2026-3271HIGHTenda F453 httpd P2pListFilterof fromP2pListFilter buffer overflowEPSS 1.1%CVE-2022-45721CRITICALIP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the picName parameter in the formDelWewifiPic function.EPSS 1.1%CVE-2022-45718CRITICALIP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formIPMacBindAdd function.EPSS 1.1%CVE-2021-42553MEDIUMSTM32 USB Host Library Buffer OverflowEPSS 1.1%CVE-2020-22524MEDIUMBuffer Overflow vulnerability in FreeImage_Load function in FreeImage Library 3.19.0(r1828) allows attackers to cuase a denial of service viEPSS 1.1%CVE-2023-22915HIGHA buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEPSS 1.1%CVE-2025-8136HIGHTOTOLINK A702R HTTP POST Request formFilter buffer overflowEPSS 1.1%CVE-2023-50245CRITICALOpenEXR-viewer memory overflow vulnerabilityEPSS 1.1%CVE-2024-8079HIGHTOTOLINK AC1200 T8 exportOvpn buffer overflowEPSS 1.1%CVE-2025-8139HIGHTOTOLINK A702R HTTP POST Request formPortFw buffer overflowEPSS 1.1%CVE-2025-7463HIGHTenda FH1201 HTTP POST Request AdvSetWrlsafeset formWrlsafeset buffer overflowEPSS 1.1%CVE-2025-8137HIGHTOTOLINK A702R HTTP POST Request formIpQoS buffer overflowEPSS 1.1%CVE-2022-20902MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20894MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20904MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20900MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20893MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20892MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20898MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%