Weaknesses of type CWE-120

3,164 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2022-45657HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.EPSS 0.8%CVE-2022-45648HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the devName parameter in the formSetDeviceName function.EPSS 0.8%CVE-2022-45656HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function.EPSS 0.8%CVE-2025-27832CRITICALAn issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpEPSS 0.8%CVE-2022-45664HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDget function.EPSS 0.8%CVE-2022-45641HIGHTenda AC6V1.0 V15.03.05.19 is vulnerable to Buffer Overflow via formSetMacFilterCfg.EPSS 0.8%CVE-2022-45658HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedEndTime parameter in the setSchedWifi function.EPSS 0.8%CVE-2022-45670HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function.EPSS 0.8%CVE-2022-45661HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the setSmartPowerManagement function.EPSS 0.8%CVE-2022-45649HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the endIp parameter in the formSetPPTPServer function.EPSS 0.8%CVE-2022-45644HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the formSetClientState function.EPSS 0.8%CVE-2022-45643HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the addWifiMacFilter function.EPSS 0.8%CVE-2022-45671HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the appData parameter in the formSetAppFilterRule function.EPSS 0.8%CVE-2022-45645HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceMac parameter in the addWifiMacFilter function.EPSS 0.8%CVE-2023-4265MEDIUMBuffer overflow in Zephyr USBEPSS 0.8%CVE-2025-31701HIGHA vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted maliEPSS 0.8%CVE-2023-45797CRITICALDreamSecurity MagicLine Buffer Overflow VulnerabilityEPSS 0.8%CVE-2025-9023HIGHTenda AC7/AC18 SetLEDCfg formSetSchedLed buffer overflowEPSS 0.8%CVE-2026-67869HIGHBuffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates inputEPSS 0.8%CVE-2026-67859HIGHBuffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling.EPSS 0.8%