Weaknesses of type CWE-120

3,246 results

Estouro de buffer clássico

A aplicação copia dados para um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente, incluindo endereços de retorno ou ponteiros de função. Isso resulta na execução de código arbitrário com os privilégios da aplicação.

Example

Um programa lê uma entrada do usuário com gets() ou strcpy() sem limitar quantos bytes podem ser copiados. Um atacante fornece uma entrada maior que o buffer, sobrescrevendo a pilha e injetando código malicioso que será executado quando a função retornar.

How to mitigate

Use funções seguras que validam limites (strncpy, snprintf, fgets) e compile com proteções de pilha ativadas (-fstack-protector-all no GCC). Além disso, implemente validação de entrada no tamanho esperado e considere linguagens com gerenciamento automático de memória para novos projetos.

CVE-2026-7857HIGHD-Link DI-8100 CGI user_group.asp sprintf buffer overflowEPSS 4.2%CVE-2015-0973HIGHBuffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent atEPSS 4.1%CVE-2026-0840HIGHUTT 进取 520W formConfigNoticeConfig strcpy buffer overflowEPSS 4.1%CVE-2025-11120HIGHTenda AC8 SetServerConfig formSetServerConfig buffer overflowEPSS 4.0%CVE-2024-24320HIGHDirectory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information aEPSS 4.0%CVE-2025-15356HIGHTenda AC20 PowerSaveSet sscanf buffer overflowEPSS 4.0%CVE-2022-38459HIGHA stack-based buffer overflow vulnerability exists in the httpd downfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A EPSS 4.0%CVE-2021-42728HIGHAdobe Bridge Buffer Overflow Arbitrary code executionEPSS 4.0%CVE-2022-24903HIGHBuffer overflow in TCP syslog server (receiver) components in rsyslogEPSS 3.9%CVE-2020-2040CRITICALPAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabledEPSS 3.9%CVE-2025-25528MEDIUMMultiple buffer overflow vulnerabilities in Wavlink WL-WN575A3 RPT75A3.V4300, which are caused by not performing strict length checks on useEPSS 3.9%CVE-2017-15134—A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled EPSS 3.9%CVE-2026-0838HIGHUTT 进取 520W ConfigWirelessBase strcpy buffer overflowEPSS 3.9%CVE-2026-0837HIGHUTT 进取 520W formFireWall strcpy buffer overflowEPSS 3.9%CVE-2026-0841HIGHUTT 进取 520W formPictureUrl strcpy buffer overflowEPSS 3.9%CVE-2025-13305HIGHD-Link DWR-M920/DWR-M921/DWR-M960/DIR-822K/DIR-825M formTracerouteDiagnosticRun buffer overflowEPSS 3.9%CVE-2026-1420HIGHTenda AC23 WifiExtraSet buffer overflowEPSS 3.8%CVE-2024-57376HIGHBuffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901C allows unauthenticaEPSS 3.7%CVE-2026-3399HIGHTenda F453 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflowEPSS 3.7%CVE-2026-3168HIGHTenda F453 httpd NatStaticSetting fromNatStaticSetting buffer overflowEPSS 3.7%