Weaknesses of type CWE-120

3,245 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2021-3466—A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remEPSS 8.7%CVE-2020-7593—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (V1.81.01 - V1.81.03), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.0EPSS 8.7%CVE-2021-28580HIGHMedium by Adobe file parsing buffer overflow vulnerability could lead to arbitrary code executionEPSS 8.5%CVE-2025-3346HIGHTenda AC7 SetPptpServerCfg formSetPPTPServer buffer overflowEPSS 7.7%CVE-2021-21051HIGHAdobe Photoshop Buffer Overflow Vulnerability Could Lead To Remote Code Execution VulnerabilityEPSS 7.7%CVE-2025-3328HIGHTenda AC1206 fast_setting_wifi_set form_fast_setting_wifi_set buffer overflowEPSS 7.6%CVE-2025-5861HIGHTenda AC7 AdvSetLanip fromadvsetlanip buffer overflowEPSS 7.6%CVE-2021-36075HIGHAdobe Bridge Buffer Overflow leads to Arbitrary Code ExecutionEPSS 7.5%CVE-2024-7157HIGHTOTOLINK A3100R getSaveConfig buffer overflowEPSS 7.4%CVE-2025-10169HIGHUTT 1200GW ConfigWirelessBase buffer overflowEPSS 7.4%CVE-2018-8784—FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corrEPSS 7.3%CVE-2018-8785—FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress() that results in a memory corruption aEPSS 7.3%CVE-2024-20450CRITICALMultiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA5EPSS 7.2%CVE-2025-4897HIGHTenda A15 HTTP POST Request multimodalAdd buffer overflowEPSS 7.2%CVE-2004-0210HIGHThe POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly bEPSS 7.2%KEVCVE-2017-16740—A Buffer Overflow issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers, Series B and C Versions 21.002 and EPSS 7.2%CVE-2025-7945HIGHD-Link DIR-513 formSetWanDhcpplus buffer overflowEPSS 7.1%CVE-2024-7217MEDIUMTOTOLINK CA300-PoE cstecgi.cgi loginauth buffer overflowEPSS 7.1%CVE-2025-5850HIGHTenda AC15 HTTP POST Request SetLEDCf formsetschedled buffer overflowEPSS 6.9%CVE-2025-5907HIGHTOTOLINK EX1200T HTTP POST Request formFilter buffer overflowEPSS 6.9%