Fallos del tipo CWE-119

3244 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2021-33481—A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in try_to_divide_boxes() in pgm2asc.c.EPSS 1.2%CVE-2021-1510HIGHCisco SD-WAN vEdge Software Buffer Overflow VulnerabilitiesEPSS 1.2%CVE-2026-1329HIGHTenda AX1803 WifiGuestSet fromGetWifiGuestBasic stack-based overflowEPSS 1.2%CVE-2021-1509HIGHCisco SD-WAN vEdge Software Buffer Overflow VulnerabilitiesEPSS 1.2%CVE-2020-3310MEDIUMCisco Firepower Device Manager On-Box Software XML Parsing VulnerabilityEPSS 1.2%CVE-2025-6128HIGHTOTOLINK EX1200T HTTP POST Request formWirelessTbl buffer overflowEPSS 1.2%CVE-2024-11047HIGHD-Link DI-8003 upgrade_filter.asp upgrade_filter_asp stack-based overflowEPSS 1.2%CVE-2023-24585HIGHAn out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted networEPSS 1.2%CVE-2024-11048HIGHD-Link DI-8003 dbsrv.asp dbsrv_asp stack-based overflowEPSS 1.2%CVE-2025-6292HIGHD-Link DIR-825 HTTP POST Request sub_4091AC stack-based overflowEPSS 1.2%CVE-2025-6291HIGHD-Link DIR-825 HTTP POST Request do_file stack-based overflowEPSS 1.2%CVE-2025-5868HIGHRT-Thread lwp_syscall.c sys_thread_sigprocmask array indexEPSS 1.2%CVE-2025-31278HIGHThe issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS SeEPSS 1.2%CVE-2020-13497MEDIUMAn exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file EPSS 1.2%CVE-2023-45234HIGHBuffer Overflow in EDK II Network PackageEPSS 1.2%CVE-2021-22713HIGHA CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION8650, ION8800, ION76EPSS 1.2%CVE-2025-4343HIGHD-Link DIR-600L formEasySetupWizard buffer overflowEPSS 1.2%CVE-2025-1897HIGHTenda TX3 SetNetControlList buffer overflowEPSS 1.2%CVE-2025-4342HIGHD-Link DIR-600L formEasySetupWizard3 buffer overflowEPSS 1.2%CVE-2025-6616HIGHD-Link DIR-619L formSetWAN_Wizard51 stack-based overflowEPSS 1.2%