Fallos del tipo CWE-119

3263 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2021-3571—A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian architecture as a PTP transparent EPSS 1.9%CVE-2021-1274HIGHCisco SD-WAN Denial of Service VulnerabilitiesEPSS 1.9%CVE-2024-23615CRITICALSymantec Messaging Gateway Buffer OverflowEPSS 1.9%CVE-2024-23616CRITICALSymantec Server Management Suite Buffer OverflowEPSS 1.9%CVE-2025-4462HIGHTOTOLINK N150RT formWsc buffer overflowEPSS 1.9%CVE-2024-12344MEDIUMTP-Link VN020 F3v(T) FTP USER Command memory corruptionEPSS 1.9%CVE-2026-7068HIGHD-Link DIR-825 nmbd sserver.c NMBD_process buffer overflowEPSS 1.9%CVE-2020-13561CRITICALAn out-of-bounds write vulnerability exists in the TIFF parser of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to coEPSS 1.9%CVE-2017-3882—A vulnerability in the Universal Plug-and-Play (UPnP) implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticatEPSS 1.8%CVE-2020-3145HIGHCisco RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Multiple VulnerabilitiesEPSS 1.8%CVE-2024-23613CRITICALSymantec Deployment Solution Remote Code ExecutionEPSS 1.8%CVE-2025-0349HIGHTenda AC6 GetParentControlInfo stack-based overflowEPSS 1.8%CVE-2019-15283HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.8%CVE-2019-15287HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.8%CVE-2019-15285HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.8%CVE-2022-24063HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User EPSS 1.8%CVE-2020-3562HIGHCisco Firepower 2100 Series SSL/TLS Inspection Denial of Service VulnerabilityEPSS 1.8%CVE-2021-1480HIGHCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.8%CVE-2022-0204HIGHA heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially craftEPSS 1.8%CVE-2018-0379—Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format (ARF) and Webex Recording Format (WEPSS 1.8%