Weaknesses of type CWE-787

5,843 results

Escrita fora dos limites da memória

Ocorre quando o código escreve dados em um endereço de memória fora do intervalo alocado para uma estrutura (array, buffer, objeto). O programa não valida o tamanho ou índice antes de escrever, permitindo sobrescrever memória adjacente — causando corrupção de dados, queda da aplicação ou execução arbitrária de código.

Example

Um formulário web que copia o valor de um campo do usuário para um buffer de 64 bytes sem verificar o comprimento: se o atacante enviar 200 caracteres, a escrita invade a memória vizinha e pode sobrescrever um ponteiro de função ou variável crítica.

How to mitigate

Sempre validar tamanhos de entrada antes de copiar (usar `strncpy` em vez de `strcpy`, ou bibliotecas seguras como `bounds-checking`); usar linguagens com verificação automática de limites (Java, Rust); aplicar testes de fuzzing e análise estática de código para detectar escritas desprotegidas.

CVE-2023-46557HIGHTOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAPVLAN.EPSS 1.0%CVE-2025-43209CRITICALAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, mEPSS 1.0%CVE-2021-37789HIGHstb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service.EPSS 1.0%CVE-2022-20603HIGHIn SetDecompContextDb of RohcDeCompContextOfRbId.cpp, there is a possible out of bounds write due to a missing bounds check. This could leadEPSS 1.0%CVE-2022-44365CRITICALTenda i21 V1.0.0.14(4656) has a stack overflow vulnerability via /goform/setSysPwd.EPSS 1.0%CVE-2022-44367CRITICALTenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setUplinkInfo.EPSS 1.0%CVE-2022-44362CRITICALTenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/AddSysLogRule.EPSS 1.0%CVE-2020-23258HIGHAn issue found in Jsish v.3.0.11 allows a remote attacker to cause a denial of service via the Jsi_ValueIsNumber function in ./src/jsiValue.EPSS 1.0%CVE-2023-47455CRITICALTenda AX1806 V1.0.0.1 contains a heap overflow vulnerability in setSchedWifi function, in which the src and v12 are directly obtained from hEPSS 1.0%CVE-2022-30176HIGHAzure RTOS GUIX Studio Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-23088CRITICALBuffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via thEPSS 1.0%CVE-2021-32995—Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-EPSS 1.0%CVE-2023-40018HIGHFreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component IDEPSS 1.0%CVE-2026-96233HIGHASP.NET Core Denial of Service VulnerabilityEPSS 1.0%CVE-2022-45511HIGHTenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the PPPOEPassword parameter at /goform/QuickIndex.EPSS 1.0%CVE-2022-35026MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b.EPSS 1.0%CVE-2022-35022MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6badae.EPSS 1.0%CVE-2022-3373HIGHOut of bounds write in V8 in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to perform an out of bounds memory write via a cEPSS 1.0%CVE-2022-35027MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7.EPSS 1.0%CVE-2022-35029MEDIUMOTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6babea.EPSS 1.0%