Fallos del tipo CWE-119

3263 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2025-5624CRITICALD-Link DIR-816 QoSPortSetup stack-based overflowEPSS 2.5%CVE-2020-7550—A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version EPSS 2.5%CVE-2020-7554—A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version EPSS 2.5%CVE-2017-3808—A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager (Cisco Unified CM) cEPSS 2.5%CVE-2026-5204HIGHTenda CH22 Parameter webtypelibrary formWebTypeLibrary stack-based overflowEPSS 2.5%CVE-2025-13188CRITICALD-Link DIR-816L authentication.cgi authenticationcgi_main stack-based overflowEPSS 2.4%CVE-2021-21951CRITICALAn out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker EufEPSS 2.4%CVE-2021-21950CRITICALAn out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker EufEPSS 2.4%CVE-2021-22714—A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION7400, PM8000 and IONEPSS 2.4%CVE-2018-14320—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is requEPSS 2.4%CVE-2018-0204—A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to creaEPSS 2.3%CVE-2017-6791—A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attacEPSS 2.3%CVE-2017-12270—A vulnerability in the gRPC code of Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series Routers could allow an unauEPSS 2.3%CVE-2017-12259—A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA51x Series IP Phones couEPSS 2.3%CVE-2017-12260—A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x EPSS 2.3%CVE-2017-12293—A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.EPSS 2.3%CVE-2018-0132—A vulnerability in the forwarding information base (FIB) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to caEPSS 2.3%CVE-2019-11926—Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memoryEPSS 2.3%CVE-2021-1433HIGHCisco IOS XE SD-WAN Software vDaemon Buffer Overflow VulnerabilityEPSS 2.3%CVE-2018-8872—In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within theEPSS 2.2%