Weaknesses of type CWE-129

324 results

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente se um índice está dentro dos limites válidos do array antes de acessá-lo. Um atacante pode fornecer um índice fora dos limites (negativo ou maior que o tamanho), causando leitura ou escrita em endereços de memória inválidos, resultando em crash, vazamento de dados ou execução de código arbitrário.

Example

Uma API web recebe um parâmetro 'posição' do usuário e acessa um array sem verificar se a posição é válida. Um atacante envia posição=-1 ou posição=999999, lendo/alterando memória adjacente ao array, ou causando segmentation fault.

How to mitigate

Sempre validar que o índice é >= 0 e < tamanho do array antes de usar. Em linguagens de alto nível, preferir iteradores ou métodos nativos que validam automaticamente; em C/C++, usar bounds checking explícito ou bibliotecas como AddressSanitizer durante testes.

CVE-2020-28602CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28631CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28629CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28604CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-35632CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-35631CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28624CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-35629CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28634CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28630CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-35630CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28603CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28609CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.0%CVE-2020-28589CRITICALAn improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader developmentEPSS 1.9%CVE-2020-12022—Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker tEPSS 1.7%CVE-2024-24563CRITICALVyper array negative index vulnerabilityEPSS 1.5%CVE-2020-11041LOWImproper Validation of Array Index in FreeRDPEPSS 1.5%CVE-2023-27349HIGHBlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 1.4%CVE-2022-42011MEDIUMAn issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can caEPSS 1.4%CVE-2020-5319HIGHDell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS SeEPSS 1.4%