Weaknesses of type CWE-120

3,164 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2022-44178CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow. via function formWifiWpsOOB.EPSS 0.7%CVE-2022-44180CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter.EPSS 0.7%CVE-2022-44172CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function R7WebsSecurityHandler.EPSS 0.7%CVE-2022-44177CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart.EPSS 0.7%CVE-2022-44171CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form_fast_setting_wifi_set.EPSS 0.7%CVE-2022-44174CRITICALTenda AC18 V15.03.05.05 is vulnerable to Buffer Overflow via function formSetDeviceName.EPSS 0.7%CVE-2023-47995MEDIUMMemory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers toEPSS 0.7%CVE-2024-46419CRITICALTOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWizardCfg function via the ssid5g parameter.EPSS 0.7%CVE-2022-43391MEDIUMA buffer overflow vulnerability in the parameter of the CGI program in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an EPSS 0.7%CVE-2025-1899HIGHTenda TX3 setPptpUserList buffer overflowEPSS 0.7%CVE-2026-28959HIGHA buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5EPSS 0.7%CVE-2024-47248MEDIUMApache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stackEPSS 0.7%CVE-2026-20664MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visioEPSS 0.7%CVE-2024-57538MEDIUMLinksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (anonymous_protect_status) is copieEPSS 0.7%CVE-2026-1158HIGHTotolink LR350 POST Request cstecgi.cgi setWizardCfg buffer overflowEPSS 0.7%CVE-2026-1156HIGHTotolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflowEPSS 0.7%CVE-2024-57540MEDIUMLinksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (action) is copied to the stack witEPSS 0.7%CVE-2024-27572HIGHLBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the updateCurAPlist function. This vulneraEPSS 0.7%CVE-2024-29507MEDIUMArtifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.EPSS 0.7%CVE-2020-8252—The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which EPSS 0.7%