Weaknesses of type CWE-125

5,105 results

Leitura fora dos limites de memória

Quando o código tenta ler dados além do tamanho alocado de um buffer, array ou estrutura de dados. O programa acessa memória que não deveria, podendo vazar informações sensíveis, causar travamento ou ser explorado para executar código arbitrário.

Example

Um validador de imagem PNG que lê o tamanho do chunk do header mas não verifica se esse tamanho é compatível com o arquivo; ao processar, lê bytes da memória adjacente, expondo dados de outras estruturas ou causando crash.

How to mitigate

Sempre validar comprimentos e índices antes de acessar buffers; usar funções seguras (strncpy em vez de strcpy, bounds checking em loops); compilar com sanitizadores (AddressSanitizer, Valgrind) para detectar em tempo de teste.

CVE-2024-37401HIGHAn out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial oEPSS 1.5%CVE-2020-12018—Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorizeEPSS 1.5%CVE-2021-34881LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.5%CVE-2021-36001LOWAdobe Character Animator PNG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.5%CVE-2023-35296MEDIUMMicrosoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityEPSS 1.5%CVE-2021-44183LOWAdobe Dimension TIF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.5%CVE-2021-31881HIGHA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.5%CVE-2024-28515CRITICALBuffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of csEPSS 1.5%CVE-2022-2183HIGHOut-of-bounds Read in vim/vimEPSS 1.5%CVE-2020-11049MEDIUMOut-of-bounds Read in FreeRDPrdp_read_share_control_headerEPSS 1.5%CVE-2021-34882LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.5%CVE-2021-46608LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16EPSS 1.5%CVE-2022-0368MEDIUMOut-of-bounds Read in vim/vimEPSS 1.5%CVE-2021-34916LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.5%CVE-2023-32045HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 1.5%CVE-2023-32044HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 1.5%CVE-2022-1069HIGHSofting Secure Integration Server Out-of-bounds ReadEPSS 1.5%CVE-2021-27606HIGHSAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC -EPSS 1.5%CVE-2021-27597HIGHSAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.EPSS 1.5%CVE-2020-6104MEDIUMAn exploitable information disclosure vulnerability exists in the get_dnode_of_data functionality of F2fs-Tools F2fs.Fsck 1.13. A specially EPSS 1.5%