Fallos del tipo CWE-119

3263 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2021-20325—Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securitEPSS 1.6%CVE-2024-1112HIGHBuffer Overflow Vulnerability in Resource HackerEPSS 1.6%CVE-2019-6541—A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow arbitrary code executioEPSS 1.6%CVE-2021-4157—An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replEPSS 1.6%CVE-2024-22373HIGHAn out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3EPSS 1.6%CVE-2022-3550MEDIUMX.org Server xkb.c _GetCountedString buffer overflowEPSS 1.6%CVE-2018-0209—A vulnerability in the Simple Network Management Protocol (SNMP) subsystem communication channel through the Cisco 550X Series Stackable ManEPSS 1.6%CVE-2025-10432CRITICALTenda AC1206 HTTP Request AdvSetMacMtuWa check_param_changed stack-based overflowEPSS 1.6%CVE-2022-27624CRITICALA vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionEPSS 1.6%CVE-2022-27625CRITICALA vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functioEPSS 1.6%CVE-2020-35522—In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial oEPSS 1.6%CVE-2025-6115HIGHD-Link DIR-619L form_macfilter stack-based overflowEPSS 1.6%CVE-2025-6114HIGHD-Link DIR-619L form_portforwarding stack-based overflowEPSS 1.6%CVE-2017-12267—A vulnerability in the Independent Computing Architecture (ICA) accelerator feature for the Cisco Wide Area Application Services (WAAS) coulEPSS 1.6%CVE-2021-46153—A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application EPSS 1.6%CVE-2020-10060HIGHUpdateHub Might Dereference An Uninitialized PointerEPSS 1.6%CVE-2021-31495HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.6%CVE-2019-8720HIGHA vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code eEPSS 1.6%KEVCVE-2025-34096CRITICALEasy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghpEPSS 1.6%CVE-2025-8168HIGHD-Link DIR-513 formSetWanPPPoE websAspInit buffer overflowEPSS 1.6%