Fallos del tipo CWE-119

3506 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2025-4462HIGHTOTOLINK N150RT formWsc buffer overflowEPSS 2.0%CVE-2021-46598HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.0%CVE-2018-0346—A vulnerability in the Zero Touch Provisioning service of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to causeEPSS 2.0%CVE-2021-43083—Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server responseEPSS 2.0%CVE-2021-34934HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.0%CVE-2020-3194HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilityEPSS 2.0%CVE-2021-20276—A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to pcre_compile() may lead to denial of servEPSS 2.0%CVE-2021-20275—A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading to denial of service.EPSS 2.0%CVE-2019-13942—A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versiEPSS 1.9%CVE-2021-3404—In ytnef 1.9.3, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) dEPSS 1.9%CVE-2020-13561CRITICALAn out-of-bounds write vulnerability exists in the TIFF parser of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to coEPSS 1.9%CVE-2025-0349HIGHTenda AC6 GetParentControlInfo stack-based overflowEPSS 1.9%CVE-2021-1274HIGHCisco SD-WAN Denial of Service VulnerabilitiesEPSS 1.9%CVE-2021-1273HIGHCisco SD-WAN Denial of Service VulnerabilitiesEPSS 1.9%CVE-2021-34306—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll libEPSS 1.9%CVE-2021-3571—A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent EPSS 1.9%CVE-2024-23616CRITICALSymantec Server Management Suite Buffer OverflowEPSS 1.9%CVE-2024-23615CRITICALSymantec Messaging Gateway Buffer OverflowEPSS 1.9%CVE-2026-107406CRITICALMemory overflow vulnerability leading to Remote Code Execution or Denial of ServiceEPSS 1.9%CVE-2024-12344MEDIUMTP-Link VN020 F3v(T) FTP USER Command memory corruptionEPSS 1.9%