Weaknesses of type CWE-120

3,164 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2026-19792HIGHTenda G0 httpd web management interface module setPortMapping buffer overflowEPSS 0.9%CVE-2026-90606CRITICALTotolink A3002MU boa formIpv6Setup buffer overflowEPSS 0.9%CVE-2026-93738CRITICALTotolink A3002MU formSchedule buffer overflowEPSS 0.9%CVE-2024-37044MEDIUMQTS, QuTS heroEPSS 0.9%CVE-2026-93739CRITICALTotolink A3002MU formWlAc buffer overflowEPSS 0.9%CVE-2026-19821HIGHTenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflowEPSS 0.9%CVE-2026-86166HIGHTenda HG10 Boa Web Server formWanRedirect buffer overflowEPSS 0.9%CVE-2024-37041MEDIUMQTS, QuTS heroEPSS 0.9%CVE-2026-90608CRITICALTotolink A3002MU boa formPortFw buffer overflowEPSS 0.9%CVE-2026-85110HIGHTenda HG10 Boa Web Server formWlanSetup buffer overflowEPSS 0.9%CVE-2026-15543HIGHTenda CH22 CertListInfo formCertListInfo buffer overflowEPSS 0.9%CVE-2022-43365HIGHIP-COM EW9 V15.11.0.14(9732) was discovered to contain a buffer overflow in the formSetDebugCfg function. This vulnerability allows attackerEPSS 0.9%CVE-2026-90605CRITICALTotolink A3002MU boa formFilter buffer overflowEPSS 0.9%CVE-2026-90607CRITICALTotolink A3002MU boa formNewSchedule buffer overflowEPSS 0.9%CVE-2021-0268HIGHJunos OS: J-Web has an Improper Neutralization of CRLF Sequences in its HTTP Headers which allows an attacker to carry out multiple types of attacks.EPSS 0.9%CVE-2026-1328HIGHTotolink NR1800X POST Request cstecgi.cgi setWizardCfg buffer overflowEPSS 0.9%CVE-2023-43504CRITICALA vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache validation service in affecEPSS 0.9%CVE-2026-8764HIGHH3C Magic B3 aspForm UpdateWanParams buffer overflowEPSS 0.9%CVE-2023-50364MEDIUMQTS, QuTS heroEPSS 0.9%CVE-2023-26110HIGHAll versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user inputEPSS 0.9%