Weaknesses of type CWE-787

5,843 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2021-27633HIGHSAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.EPSS 1.5%CVE-2021-27628HIGHSAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.2EPSS 1.5%CVE-2022-26022HIGHRockwell Automation Studio 5000 Logix Designer Out-of-Bounds WriteEPSS 1.5%CVE-2023-40567MEDIUMOut-Of-Bounds Write in FreeRDPEPSS 1.5%CVE-2018-3860HIGHAn exploitable out-of-bounds write exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image proEPSS 1.5%CVE-2018-3871HIGHAn exploitable out-of-bounds write exists in the PCX parsing functionality of Canvas Draw version 4.0.0. A specially crafted PCX image proceEPSS 1.5%CVE-2023-27973CRITICALCertain HP LaserJet Pro print products are potentially vulnerable to Heap Overflow and/or Remote Code Execution.EPSS 1.5%CVE-2023-25139CRITICALsprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This isEPSS 1.5%CVE-2022-26376MEDIUMA memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New GeEPSS 1.5%CVE-2022-1015—A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cauEPSS 1.5%CVE-2021-41159MEDIUMImproper client input validation for FreeRDP gateway connections allows to overwrite memoryEPSS 1.5%CVE-2021-25678—A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2020 (All versions < SE2020MP14), Solid EEPSS 1.5%CVE-2022-45685HIGHA stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.EPSS 1.5%CVE-2022-45693HIGHJettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a DeniEPSS 1.5%CVE-2020-1891—A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhEPSS 1.5%CVE-2010-20115CRITICALVermillion FTP <= 1.31 Daemon PORT Command Memory CorruptionEPSS 1.5%CVE-2020-27337HIGHAn issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the IPv6 component allows an unauthenticated remote attaEPSS 1.5%CVE-2022-46566HIGHD-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetEPSS 1.5%CVE-2022-46562HIGHD-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the PSK parameter in the SetQuickEPSS 1.5%CVE-2022-46568HIGHD-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the AccountPassword parameter in EPSS 1.5%