Fallos del tipo CWE-119

3263 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2025-3618HIGHLocal Privilege Escalation VulnerabilityEPSS 1.8%CVE-2019-1892HIGHCisco Small Business Series Switches Memory Corruption VulnerabilityEPSS 1.8%CVE-2019-12673HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Denial of Service VulnerabilityEPSS 1.8%CVE-2021-3498—GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.EPSS 1.8%CVE-2021-32992—FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may alEPSS 1.8%CVE-2007-5928HIGHOpenBase 10.0.5 and earlier allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECTEPSS 1.8%CVE-2024-0532HIGHTenda A15 Web-based Management Interface WifiExtraSet set_repeat5 stack-based overflowEPSS 1.8%CVE-2024-11960HIGHD-Link DIR-605L formSetPortTr buffer overflowEPSS 1.8%CVE-2024-11959HIGHD-Link DIR-605L formResetStatistic buffer overflowEPSS 1.8%CVE-2017-6745—A vulnerability in the cache server within Cisco Videoscape Distribution Suite (VDS) for Television 3.2(5)ES1 could allow an unauthenticatedEPSS 1.7%CVE-2018-0103—A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a local attackEPSS 1.7%CVE-2019-1772HIGHCisco Webex Network Recording Player Arbitrary Code Execution VulnerabilityEPSS 1.7%CVE-2019-1773HIGHCisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesEPSS 1.7%CVE-2019-3561—Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versionEPSS 1.7%CVE-2020-13496MEDIUMAn exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file EPSS 1.7%CVE-2021-44016—A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (AlEPSS 1.7%CVE-2022-32934HIGHThe issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. A rEPSS 1.7%CVE-2021-32994HIGHSofting OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory BufferEPSS 1.7%CVE-2024-3832HIGHObject corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a craEPSS 1.7%CVE-2017-12359—A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files could allow an attacker tEPSS 1.7%