Weaknesses of type CWE-787

5,145 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2021-32998HIGHThe FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbEPSS 1.2%CVE-2024-22751CRITICALD-Link DIR-882 DIR882A1_FW130B06 was discovered to contain a stack overflow via the sub_477AA0 function.EPSS 1.2%CVE-2023-25283HIGHA stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1EPSS 1.2%CVE-2024-12648CRITICALBuffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker onEPSS 1.2%CVE-2024-21661HIGHArgo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded EnvironmentEPSS 1.2%CVE-2023-34609HIGHAn issue was discovered flexjson thru 3.3 allows attackers to cause a denial of service or other unspecified impacts via crafted object thatEPSS 1.2%CVE-2022-42863HIGHA memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iEPSS 1.2%CVE-2021-22752—A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data orEPSS 1.2%CVE-2021-22754—A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data orEPSS 1.2%CVE-2021-22750—A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21041 and prior that could result in loss of data orEPSS 1.2%CVE-2023-49355HIGHdecToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. NOTE: this is notEPSS 1.2%CVE-2021-44005—A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_LoadeEPSS 1.2%CVE-2026-85437CRITICALMOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String DecodersEPSS 1.2%CVE-2021-44006—A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_LoadeEPSS 1.2%CVE-2022-40008CRITICALSWFTools commit 772e55a was discovered to contain a heap-buffer overflow via the function readU8 at /lib/ttf.c.EPSS 1.2%CVE-2019-12810—A memory corruption vulnerability exists in the .PSD parsing functionality of ALSee v5.3 ~ v8.39. A specially crafted .PSD file can cause anEPSS 1.2%CVE-2022-3045HIGHInsufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heEPSS 1.2%CVE-2023-37712CRITICALTenda AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408) were discovered to contain a stack overflow in the page parameterEPSS 1.2%CVE-2020-25171—Fuji Electric V-Server LiteEPSS 1.2%CVE-2023-4154HIGHSamba: ad dc password exposure to privileged users and rodcsEPSS 1.2%