Fallos del tipo CWE-119

3506 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2026-7068HIGHD-Link DIR-825 nmbd sserver.c NMBD_process buffer overflowEPSS 1.9%CVE-2017-3882—A vulnerability in the Universal Plug-and-Play (UPnP) implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticatEPSS 1.8%CVE-2020-3145HIGHCisco RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Multiple VulnerabilitiesEPSS 1.8%CVE-2024-23613CRITICALSymantec Deployment Solution Remote Code ExecutionEPSS 1.8%CVE-2022-27624CRITICALA vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionEPSS 1.8%CVE-2022-27625CRITICALA vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functioEPSS 1.8%CVE-2020-3562HIGHCisco Firepower 2100 Series SSL/TLS Inspection Denial of Service VulnerabilityEPSS 1.8%CVE-2019-15287HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.8%CVE-2019-15283HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.8%CVE-2019-15285HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.8%CVE-2022-24063HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User EPSS 1.8%CVE-2021-1480HIGHCisco SD-WAN vManage Software VulnerabilitiesEPSS 1.8%CVE-2025-34096CRITICALEasy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghpEPSS 1.8%CVE-2022-0204HIGHA heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially craftEPSS 1.8%CVE-2018-0379—Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format (ARF) and Webex Recording Format (WEPSS 1.8%CVE-2019-12673HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Denial of Service VulnerabilityEPSS 1.8%CVE-2025-3618HIGHLocal Privilege Escalation VulnerabilityEPSS 1.8%CVE-2019-1892HIGHCisco Small Business Series Switches Memory Corruption VulnerabilityEPSS 1.8%CVE-2021-32992—FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may alEPSS 1.8%CVE-2007-5928HIGHOpenBase 10.0.5 and earlier allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECTEPSS 1.8%