Fallos del tipo CWE-119

3266 resultados

Corrupção de memória genérica

Fraqueza genérica que descreve quando software escreve dados fora dos limites esperados de um buffer ou estrutura de memória, sobrescrevendo dados adjacentes. Permite ao atacante corromper dados críticos, executar código arbitrário ou derrubar a aplicação.

Ejemplo

Um programa C que copia uma string do usuário para um array fixo sem validar comprimento: strcpy(buffer, user_input) em um buffer de 64 bytes, quando o input tem 200 caracteres. Os dados transbordados sobrescrevem variáveis, ponteiros ou endereços de retorno na pilha.

Cómo mitigar

Use funções seguras de cópia (strncpy, strlcpy, memcpy com tamanho validado), implemente validação de entrada e comprimento antes de qualquer operação de escrita em buffer, e ative proteções de compilador como stack canaries e ASLR. Em linguagens modernas (Rust, Go), o gerenciamento automático de memória elimina essa classe de bugs.

CVE-2024-27851HIGHThe issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 1EPSS 0.8%CVE-2025-7597HIGHTenda AX1803 setMacFilterCfg formSetMacFilterCfg stack-based overflowEPSS 0.8%CVE-2025-7416HIGHTenda O3V2 httpd setSysTimeInfo fromSysToolTime stack-based overflowEPSS 0.8%CVE-2025-7596HIGHTenda FH1205 WifiExtraSet formWifiExtraSet stack-based overflowEPSS 0.8%CVE-2025-7423HIGHTenda O3V2 httpd setWrlFilterList formWifiMacFilterSet stack-based overflowEPSS 0.8%CVE-2025-7422HIGHTenda O3V2 httpd setNetworkService setAutoReboot stack-based overflowEPSS 0.8%CVE-2025-7550HIGHTenda FH1201 GstDhcpSetSer fromGstDhcpSetSer stack-based overflowEPSS 0.8%CVE-2025-7418HIGHTenda O3V2 httpd setPing fromPingResultGet stack-based overflowEPSS 0.8%CVE-2025-7598HIGHTenda AX1803 setWifiFilterCfg formSetWifiMacFilterCfg stack-based overflowEPSS 0.8%CVE-2025-7421HIGHTenda O3V2 httpd operateMacFilter fromMacFilterModify stack-based overflowEPSS 0.8%CVE-2025-7549HIGHTenda FH1201 L7Prot frmL7ProtForm stack-based overflowEPSS 0.8%CVE-2025-7417HIGHTenda O3V2 httpd setPingInfo fromNetToolGet stack-based overflowEPSS 0.8%CVE-2025-7460HIGHTOTOLINK T6 HTTP POST Request cstecgi.cgi setWiFiAclRules buffer overflowEPSS 0.8%CVE-2025-7548HIGHTenda FH1201 SafeEmailFilter formSafeEmailFilter stack-based overflowEPSS 0.8%CVE-2025-7420HIGHTenda O3V2 httpd setWrlBasicInfo formWifiBasicSet stack-based overflowEPSS 0.8%CVE-2025-7419HIGHTenda O3V2 httpd setRateTest fromSpeedTestSet stack-based overflowEPSS 0.8%CVE-2021-43315—A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). ThEPSS 0.8%CVE-2024-27879HIGHThe issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18. An attacker may EPSS 0.8%CVE-2021-43313—A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggEPSS 0.8%CVE-2021-43311—A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). TheEPSS 0.8%