Fallos del tipo CWE-119

3264 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2025-4356HIGHTenda DAP-1520 Authentication storage mod_graph_auth_uri_handler stack-based overflowEPSS 1.5%CVE-2022-25959HIGHRockwell Automation Studio 5000 Logix Designer Improper Restriction of Operations within the Bounds of a Memory BufferEPSS 1.5%CVE-2025-9527HIGHLinksys E1700 QoSSetup stack-based overflowEPSS 1.5%CVE-2019-1924HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.5%CVE-2019-1927HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.5%CVE-2025-6098CRITICALUTT 进取 750W API setSysAdm strcpy buffer overflowEPSS 1.5%CVE-2017-2575—A vulnerability was found while fuzzing libbpg 0.9.7. It is a NULL pointer dereference issue due to missing check of the return value of funEPSS 1.5%CVE-2025-35003CRITICALApache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.EPSS 1.5%CVE-2025-1538HIGHD-Link DAP-1320 api set_ws_action heap-based overflowEPSS 1.5%CVE-2019-1929HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.5%CVE-2019-1928HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.5%CVE-2019-1925HIGHCisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesEPSS 1.5%CVE-2025-1853HIGHTenda AC8 Parameter SetIpMacBind sub_49E098 stack-based overflowEPSS 1.4%CVE-2019-1641HIGHCisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesEPSS 1.4%CVE-2025-4346HIGHD-Link DIR-600L formSetWAN_Wizard534 buffer overflowEPSS 1.4%CVE-2025-4345HIGHD-Link DIR-600L formSetLog buffer overflowEPSS 1.4%CVE-2025-4344HIGHD-Link DIR-600L formLogin buffer overflowEPSS 1.4%CVE-2021-21833CRITICALAn improper array index validation vulnerability exists in the TIF IP_planar_raster_unpack functionality of Accusoft ImageGear 19.9. A speciEPSS 1.4%CVE-2024-8573HIGHTOTOLINK AC1200 T8/AC1200 T10 cstecgi.cgi setParentalRules buffer overflowEPSS 1.4%CVE-2019-1214HIGHAn elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aEPSS 1.4%KEV