Weaknesses of type CWE-120

3,246 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2025-5907HIGHTOTOLINK EX1200T HTTP POST Request formFilter buffer overflowEPSS 6.9%CVE-2025-45779CRITICALTenda AC10 V1.0re_V15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST parameter.EPSS 6.8%CVE-2025-5739HIGHTOTOLINK X15 HTTP POST Request formSaveConfig buffer overflowEPSS 6.7%CVE-2024-50667CRITICALThe boa httpd of Trendnet TEW-820AP 1.01.B01 has a stack overflow vulnerability in /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, /boafrm/formEPSS 6.7%CVE-2021-28548HIGHAdobe Photoshop parsing JS buffer overflow vulnerability could lead to arbitrary code executionEPSS 6.7%CVE-2024-20454CRITICALMultiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA5EPSS 6.6%CVE-2024-54887HIGHTP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /userEPSS 6.6%CVE-2025-5902HIGHTOTOLINK T10 POST Request cstecgi.cgi setUpgradeFW buffer overflowEPSS 6.5%CVE-2021-28549HIGHAdobe Photoshop parsing JS buffer overflow vulnerability could lead to arbitrary code executionEPSS 6.5%CVE-2025-5790HIGHTOTOLINK X15 HTTP POST Request formIpQoS buffer overflowEPSS 6.5%CVE-2025-5788HIGHTOTOLINK X15 HTTP POST Request formReflashClientTbl buffer overflowEPSS 6.5%CVE-2025-5785HIGHTOTOLINK X15 HTTP POST Request formWirelessTbl buffer overflowEPSS 6.5%CVE-2025-5786HIGHTOTOLINK X15 HTTP POST Request formDMZ buffer overflowEPSS 6.5%CVE-2025-5787HIGHTOTOLINK X15 HTTP POST Request formWsc buffer overflowEPSS 6.5%CVE-2025-14708CRITICALShiguangwu sgwbox N3 WIREDCFGGET http_eshell_server buffer overflowEPSS 6.5%CVE-2025-5792HIGHTOTOLINK EX1200T HTTP POST Request formWlanRedirect buffer overflowEPSS 6.3%CVE-2024-52759LOWD-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ip_position_asp function.EPSS 6.0%CVE-2022-22728—libapreq2 multipart form parse memory corruptionEPSS 5.9%CVE-2026-7854CRITICALD-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflowEPSS 5.9%CVE-2025-14709CRITICALShiguangwu sgwbox N3 WIRELESSCFGGET http_eshell_server buffer overflowEPSS 5.9%