Weaknesses of type CWE-787

5,143 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2022-43000CRITICALD-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/form2WizardStep4.EPSS 1.2%CVE-2022-44202CRITICALD-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow.EPSS 1.2%CVE-2022-44806CRITICALD-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow.EPSS 1.2%CVE-2022-43001CRITICALD-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function.EPSS 1.2%CVE-2022-43002CRITICALD-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/form2WizardStep54.EPSS 1.2%CVE-2023-24343HIGHD-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSchedule.EPSS 1.2%CVE-2023-5176CRITICALMemory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruptionEPSS 1.2%CVE-2021-24042CRITICALThe calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.EPSS 1.2%CVE-2023-31146HIGHVyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignmentEPSS 1.2%CVE-2021-3751CRITICALOut-of-bounds Write in bfabiszewski/libmobiEPSS 1.2%CVE-2023-29665CRITICALD-Link DIR823G_V1.0.2B05 was discovered to contain a stack overflow via the NewPassword parameters in SetPasswdSettings.EPSS 1.2%CVE-2023-24351CRITICALD-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the FILECODE parameter at /goform/formLogin.EPSS 1.2%CVE-2022-42998CRITICALD-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd.EPSS 1.2%CVE-2020-36885CRITICALSony IPELA Network Camera 1.82.01 Remote Stack Buffer Overflow via ftpclient.cgiEPSS 1.2%CVE-2024-0229HIGHXorg-x11-server: reattaching to different master device may lead to out-of-bounds memory accessEPSS 1.2%CVE-2023-48695HIGHAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 1.2%CVE-2022-46696HIGHA memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iEPSS 1.2%CVE-2024-34199HIGHTinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sending excessively largeEPSS 1.2%CVE-2023-24347HIGHD-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formSetWanDhcppluEPSS 1.2%CVE-2023-23306CRITICALThe `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can rEPSS 1.2%