Weaknesses of type CWE-120

3,164 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2022-31482HIGHDenial-of-Service via internal structure overflowEPSS 1.0%CVE-2026-7055HIGHTenda F456 httpd VirtualSer fromVirtualSer buffer overflowEPSS 1.0%CVE-2025-6393HIGHTOTOLINK A702R/A3002R/A3002RU/EX1200T HTTP POST Request formIPv6Addr buffer overflowEPSS 1.0%CVE-2023-27063CRITICALTenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the DNSDomainName parameter in the fEPSS 1.0%CVE-2023-27061CRITICALTenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the wifiFilterListRemark parameter iEPSS 1.0%CVE-2026-7719CRITICALTotolink WA300 POST Request cstecgi.cgi loginauth buffer overflowEPSS 1.0%CVE-2026-7747CRITICALTotolink N300RH Parameter cstecgi.cgi loginauth buffer overflowEPSS 1.0%CVE-2024-7212HIGHTOTOLINK A7000R cstecgi.cgi loginauth buffer overflowEPSS 1.0%CVE-2012-10035CRITICALTurbo FTP Server 1.30.823/826 PORT Command Buffer OverflowEPSS 1.0%CVE-2023-27989MEDIUMA buffer overflow vulnerability in the CGI program of the Zyxel NR7101 firmware versions prior to V1.00(ABUV.8)C0 could allow a remote authEPSS 1.0%CVE-2026-76674CRITICALUnauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN GatewaysEPSS 1.0%CVE-2026-7056HIGHTenda F456 httpd SafeUrlFilter fromSafeUrlFilter buffer overflowEPSS 1.0%CVE-2025-6149HIGHTOTOLINK A3002R HTTP POST Request formSysLog buffer overflowEPSS 1.0%CVE-2025-6150HIGHTOTOLINK X15 HTTP POST Request formMultiAP buffer overflowEPSS 1.0%CVE-2025-12595HIGHTenda AC23 SetVirtualServerCfg formSetVirtualSer buffer overflowEPSS 1.0%CVE-2025-6148HIGHTOTOLINK A3002RU HTTP POST Request formSysLog buffer overflowEPSS 1.0%CVE-2026-3699HIGHUTT HiPER 810G formRemoteControl strcpy buffer overflowEPSS 1.0%CVE-2026-3273HIGHTenda F453 httpd AdvSetWrlsafeset formWrlsafeset buffer overflowEPSS 1.0%CVE-2026-7019HIGHTenda F456 P2pListFilter fromP2pListFilter buffer overflowEPSS 1.0%CVE-2026-3398HIGHTenda F453 httpd AdvSetWan fromAdvSetWan buffer overflowEPSS 1.0%