Fallos del tipo CWE-120

3166 resultados

Execução de código ou comandos não autorizados

Fraqueza em que a aplicação executa código ou comandos sem validar adequadamente a origem, permissões ou conteúdo fornecido por um atacante. O perigo está em permitir que um usuário sem privilégios execute operações restritas, como comandos do sistema, funções administrativas ou código arbitrário, comprometendo toda a segurança da aplicação.

Ejemplo

Um painel de controle que permite ao usuário executar scripts de manutenção sem autenticação apropriada, ou uma função que passa entrada do usuário diretamente para eval() em Python/JavaScript, permitindo injeção de código malicioso que roda com as permissões da aplicação.

Cómo mitigar

Implemente validação rigorosa de entrada, use allowlists (não blacklists), mantenha controle de acesso baseado em roles (RBAC) com verificação em cada operação sensível, e evite construtores dinâmicos como eval(). Quando precisar executar comandos do sistema, use APIs seguras e nunca passe entrada do usuário sem sanitização completa.

CVE-2021-47797MEDIUMLeawo Prof. Media 11.0.0.1 - Denial of Service (DoS) (PoC)EPSS 0.4%CVE-2024-40083CRITICALA Buffer Overflow vulnerabilty in the local_app_set_router_token function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticEPSS 0.4%CVE-2024-50996MEDIUMNetgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the bpaEPSS 0.4%CVE-2024-50997MEDIUMNetgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptEPSS 0.4%CVE-2023-1452MEDIUMGPAC load_text.c buffer overflowEPSS 0.4%CVE-2025-50641MEDIUMTenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the addWifiMacFilter function via the parameter deviceId.EPSS 0.4%CVE-2026-19002HIGHCrafted database metadata may cause memory corruption in MongoDB BI Connector ODBC DriverEPSS 0.4%CVE-2025-2851HIGHGL.iNet GL-A1300 Slate Plus RPC plugins.so buffer overflowEPSS 0.4%CVE-2025-24956MEDIUMA vulnerability has been identified in OpenV2G (All versions < V0.9.6). The OpenV2G EXI parsing feature is missing a length check when parsiEPSS 0.4%CVE-2026-57273HIGHGeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityEPSS 0.4%CVE-2026-57278HIGHGeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityEPSS 0.4%CVE-2026-57277HIGHGeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityEPSS 0.4%CVE-2026-57276HIGHGeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityEPSS 0.4%CVE-2026-57274HIGHGeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityEPSS 0.4%CVE-2026-57275HIGHGeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilityEPSS 0.4%CVE-2025-63679CRITICALfree5gc v4.1.0 and before is vulnerable to Buffer Overflow. When AMF receives an UplinkRANConfigurationTransfer NGAP message from a gNB, theEPSS 0.4%CVE-2026-84571MEDIUMA buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, vEPSS 0.4%CVE-2021-33973HIGHBuffer Overflow vulnerability in Qihoo 360 Safe guard v12.1.0.1004, v12.1.0.1005, v13.1.0.1001 allows attacker to escalate priveleges.EPSS 0.4%CVE-2023-4041CRITICALSecond Stage Gecko Bootloader GBL Parser Buffer Overrun VulnerabilityEPSS 0.4%CVE-2020-37204MEDIUMRemShutdown 2.9.0.0 - 'Key' Denial of ServiceEPSS 0.4%