Weaknesses of type CWE-120

3,244 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2025-8180HIGHTenda CH22 deleteUserName formdeleteUserName buffer overflowEPSS 12.3%CVE-2025-5904HIGHTOTOLINK T10 POST Request cstecgi.cgi setWiFiMeshName buffer overflowEPSS 12.1%CVE-2025-5903HIGHTOTOLINK T10 POST Request cstecgi.cgi setWiFiAclRules buffer overflowEPSS 12.1%CVE-2023-20189HIGHCisco Small Business Series Switches Buffer Overflow VulnerabilitiesEPSS 12.0%CVE-2022-22805—A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code executioEPSS 11.9%CVE-2025-9961HIGHAuthenticated RCE by CWMP binaryEPSS 11.5%CVE-2025-8138HIGHTOTOLINK A702R HTTP POST Request formOneKeyAccessButton buffer overflowEPSS 11.3%CVE-2025-8140HIGHTOTOLINK A702R HTTP POST Request formWlanMultipleAP buffer overflowEPSS 11.3%CVE-2023-20159HIGHCisco Small Business Series Switches Buffer Overflow VulnerabilitiesEPSS 11.1%CVE-2023-20160HIGHCisco Small Business Series Switches Buffer Overflow VulnerabilitiesEPSS 11.1%CVE-2023-20161HIGHCisco Small Business Series Switches Buffer Overflow VulnerabilitiesEPSS 11.1%CVE-2024-7463HIGHTOTOLINK CP900 cstecgi.cgi UploadCustomModule buffer overflowEPSS 11.0%CVE-2019-5064HIGHAn exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A EPSS 10.7%CVE-2020-15069CRITICALSophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientlesEPSS 10.7%KEVCVE-2022-23747—In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed EPSS 10.5%CVE-2023-29468CRITICALThe Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_EEPSS 10.1%CVE-2024-37357CRITICALA buffer overflow vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTEPSS 10.0%CVE-2022-41966HIGHXStream Denial of Service via stack overflow EPSS 9.3%CVE-2022-45672HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the formWx3AuthorizeSet function.EPSS 9.1%CVE-2023-50991HIGHBuffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote attackers to cause a denial of service (DoSEPSS 8.8%