Weaknesses of type CWE-125

5,105 results

Leitura fora dos limites de memória

Quando o código tenta ler dados além do tamanho alocado de um buffer, array ou estrutura de dados. O programa acessa memória que não deveria, podendo vazar informações sensíveis, causar travamento ou ser explorado para executar código arbitrário.

Example

Um validador de imagem PNG que lê o tamanho do chunk do header mas não verifica se esse tamanho é compatível com o arquivo; ao processar, lê bytes da memória adjacente, expondo dados de outras estruturas ou causando crash.

How to mitigate

Sempre validar comprimentos e índices antes de acessar buffers; usar funções seguras (strncpy em vez de strcpy, bounds checking em loops); compilar com sanitizadores (AddressSanitizer, Valgrind) para detectar em tempo de teste.

CVE-2021-46600LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16EPSS 1.6%CVE-2021-34943LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.6%CVE-2021-34944LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.6%CVE-2023-24924HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.6%CVE-2022-0623MEDIUMOut-of-bounds Read in mruby/mrubyEPSS 1.6%CVE-2019-10129MEDIUMA vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can EPSS 1.6%CVE-2023-32034MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2023-32035MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2023-33164MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2023-35318MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2023-35319MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2023-35314MEDIUMRemote Procedure Call Runtime Denial of Service VulnerabilityEPSS 1.6%CVE-2022-1851HIGHOut-of-bounds Read in vim/vimEPSS 1.6%CVE-2022-33319HIGHOut-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GEPSS 1.6%CVE-2024-37338HIGHMicrosoft SQL Server Native Scoring Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-46611LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16EPSS 1.6%CVE-2021-20254—A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that perEPSS 1.6%CVE-2017-2579LOWAn out-of-bounds read vulnerability was found in netpbm before 10.61. The expandCodeOntoStack() function has an insufficient code value checEPSS 1.6%CVE-2024-3159HIGHOut of bounds memory access in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to perform arbitrary read/write via a cEPSS 1.6%CVE-2021-46630LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.6%