Weaknesses of type CWE-787

5,843 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2022-35061MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e412a.EPSS 1.0%CVE-2022-35034MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e7e3d.EPSS 1.0%CVE-2022-35068MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e420d.EPSS 1.0%CVE-2022-35060MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0a32.EPSS 1.0%CVE-2022-35037MEDIUMOTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6adb1e.EPSS 1.0%CVE-2023-1220HIGHHeap buffer overflow in UMA in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to poEPSS 1.0%CVE-2023-1219HIGHHeap buffer overflow in Metrics in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process tEPSS 1.0%CVE-2023-24164CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_000c2318.EPSS 1.0%CVE-2023-24165CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/initIpAddrInfo.EPSS 1.0%CVE-2024-24543CRITICALBuffer Overflow vulnerability in the function setSchedWifi in Tenda AC9 v.3.0, firmware version v.15.03.06.42_multi allows a remote attackerEPSS 1.0%CVE-2023-24170CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/fromSetWirelessRepeat.EPSS 1.0%CVE-2023-24167CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/add_white_node.EPSS 1.0%CVE-2023-32874CRITICALIn Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no EPSS 1.0%CVE-2022-34748—A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write paEPSS 1.0%CVE-2026-85440CRITICALMOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet LengthEPSS 1.0%CVE-2022-22026HIGHWindows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2021-31374HIGHJunos OS and Junos OS Evolved: RPD crash while processing a specially crafted BGP UPDATE or KEEPALIVE message.EPSS 1.0%CVE-2019-19276—A vulnerability has been identified in SIMATIC HMI Comfort Panels 1st Generation (incl. SIPLUS variants) (All versions < V16 Update 4), SIMAEPSS 1.0%CVE-2022-43260CRITICALTenda AC18 V15.03.05.19(6318) was discovered to contain a stack overflow via the time parameter in the fromSetSysTime function.EPSS 1.0%CVE-2023-32981HIGHAn arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted aEPSS 1.0%