Weaknesses of type CWE-120

3,164 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2022-20912MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20895MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20892MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20899MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20897MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20902MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20894MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20893MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2022-20896MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilitiesEPSS 1.0%CVE-2026-3016HIGHUTT HiPER 810G formP2PLimitConfig strcpy buffer overflowEPSS 1.0%CVE-2026-3165HIGHTenda F453 httpd AdvSetWrlsafeset fromSetWifiGusetBasic buffer overflowEPSS 1.0%CVE-2026-3167HIGHTenda F453 httpd webtypelibrary formWebTypeLibrary buffer overflowEPSS 1.0%CVE-2026-2904HIGHUTT HiPER 810G ConfigExceptAli strcpy buffer overflowEPSS 1.0%CVE-2026-2981HIGHUTT HiPER 810G formTaskEdit_ap strcpy buffer overflowEPSS 1.0%CVE-2026-3015HIGHUTT HiPER 810G formPolicyRouteConf strcpy buffer overflowEPSS 1.0%CVE-2026-3168HIGHTenda F453 httpd NatStaticSetting fromNatStaticSetting buffer overflowEPSS 1.0%CVE-2026-3169HIGHTenda F453 httpd SafeEmailFilter fromSafeEmailFilter buffer overflowEPSS 1.0%CVE-2026-3166HIGHTenda F453 httpd RouteStatic fromRouteStatic buffer overflowEPSS 1.0%CVE-2026-2911HIGHTenda FH451 GstDhcpSetSer buffer overflowEPSS 1.0%CVE-2024-33365HIGHBuffer Overflow vulnerability in Tenda AC10 v4 US_AC10V4.0si_V16.03.10.20_cn allows a remote attacker to execute arbitrary code via the VirtEPSS 1.0%