Weaknesses of type CWE-787

5,146 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2022-28300HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation 10.16.02.034 CONNECT.EPSS 1.0%CVE-2022-28301HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 1.0%CVE-2022-40106HIGHTenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the set_local_time function. This vulnerability allows attackers to EPSS 1.0%CVE-2021-26252—A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in pspdf_prepare_page(),in ps-pdf.cxx may lead to execute arbitrary code and deEPSS 1.0%CVE-2023-25218CRITICALTenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the form_fast_setting_wifi_set function. This vulnerabilEPSS 1.0%CVE-2023-25220CRITICALTenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the add_white_node function. This vulnerability allows aEPSS 1.0%CVE-2022-28314HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 1.0%CVE-2022-28316HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. EPSS 1.0%CVE-2023-4353HIGHHeap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via aEPSS 1.0%CVE-2024-47537HIGHGHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.cEPSS 1.0%CVE-2022-45511HIGHTenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the PPPOEPassword parameter at /goform/QuickIndex.EPSS 1.0%CVE-2022-43294CRITICALTasmota before commit 066878da4d4762a9b6cb169fdf353e804d735cfd was discovered to contain a stack overflow via the ClientPortPtr parameter atEPSS 1.0%CVE-2022-3052HIGHHeap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced EPSS 1.0%CVE-2014-125106CRITICALNanopb before 0.3.1 allows size_t overflows in pb_dec_bytes and pb_dec_string.EPSS 0.9%CVE-2023-23086CRITICALBuffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString function.EPSS 0.9%CVE-2023-32887HIGHIn Modem IMS Stack, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no addiEPSS 0.9%CVE-2023-32888HIGHIn Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service witEPSS 0.9%CVE-2021-21871HIGHA memory corruption vulnerability exists in the DMG File Format Handler functionality of PowerISO 7.9. A specially crafted DMG file can leadEPSS 0.9%CVE-2019-25614CRITICALFree Float FTP 1.0 STOR Command Remote Buffer OverflowEPSS 0.9%CVE-2024-44244MEDIUMA memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 18.1, iOS 18.1 and iPadOS 18.1, macOS EPSS 0.9%