Weaknesses of type CWE-120

3,164 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2025-10120HIGHTenda AC20 GetParentControlInfo strcpy buffer overflowEPSS 0.8%CVE-2025-5629HIGHTenda AC10 HTTP SetPptpServerCfg formSetPPTPServer buffer overflowEPSS 0.8%CVE-2020-9247—There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parametEPSS 0.8%CVE-2025-5408CRITICALWAVLINK WL-WN576K1 HTTP POST Request login.cgi sys_login buffer overflowEPSS 0.8%CVE-2023-33457HIGHIn Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash.EPSS 0.8%CVE-2024-5243HIGHTP-Link Omada ER605 Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-51888HIGHBuffer Overflow vulnerability in the nomath() function in Mathtex v.1.05 and before allows a remote attacker to cause a denial of service viEPSS 0.8%CVE-2023-51886HIGHBuffer Overflow vulnerability in the main() function in Mathtex 1.05 and before allows a remote attacker to cause a denial of service when uEPSS 0.8%CVE-2025-12622HIGHTenda AC10 SysRunCmd formSysRunCmd buffer overflowEPSS 0.8%CVE-2022-45671HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the appData parameter in the formSetAppFilterRule function.EPSS 0.8%CVE-2022-45663HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function.EPSS 0.8%CVE-2022-45660HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedStartTime parameter in the setSchedWifi function.EPSS 0.8%CVE-2022-45647HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeed parameter in the formSetClientState function.EPSS 0.8%CVE-2022-45656HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function.EPSS 0.8%CVE-2022-45646HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeedUp parameter in the formSetClientState function.EPSS 0.8%CVE-2026-9698HIGHDBI versions before 1.648 for Perl saved errors in a limited-sized bufferEPSS 0.8%CVE-2022-45653HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the page parameter in the fromNatStaticSetting function.EPSS 0.8%CVE-2022-45650HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the firewallEn parameter in the formSetFirewallCfg function.EPSS 0.8%CVE-2022-45648HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the devName parameter in the formSetDeviceName function.EPSS 0.8%CVE-2022-45655HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the timeZone parameter in the form_fast_setting_wifi_set functionEPSS 0.8%