Fallos del tipo CWE-120

3164 resultados

Execução de código ou comandos não autorizados

Fraqueza em que a aplicação executa código ou comandos sem validar adequadamente a origem, permissões ou conteúdo fornecido por um atacante. O perigo está em permitir que um usuário sem privilégios execute operações restritas, como comandos do sistema, funções administrativas ou código arbitrário, comprometendo toda a segurança da aplicação.

Ejemplo

Um painel de controle que permite ao usuário executar scripts de manutenção sem autenticação apropriada, ou uma função que passa entrada do usuário diretamente para eval() em Python/JavaScript, permitindo injeção de código malicioso que roda com as permissões da aplicação.

Cómo mitigar

Implemente validação rigorosa de entrada, use allowlists (não blacklists), mantenha controle de acesso baseado em roles (RBAC) com verificação em cada operação sensível, e evite construtores dinâmicos como eval(). Quando precisar executar comandos do sistema, use APIs seguras e nunca passe entrada do usuário sem sanitização completa.

CVE-2022-41028HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 2.4%CVE-2021-42785—Buffer Overflow in tvnviewer.exe via Crafted Packet in TightVNC Viewer 2.8.59EPSS 2.3%CVE-2021-34829HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA rouEPSS 2.3%CVE-2021-34828HIGHThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA rouEPSS 2.3%CVE-2022-29246CRITICALPotential buffer overflow in function DFU upload in Azure RTOS USBXEPSS 2.3%CVE-2020-8215—A buffer overflow is present in canvas version <= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it procEPSS 2.3%CVE-2016-9363HIGHAn issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions pEPSS 2.3%CVE-2020-10022CRITICALUpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size ArrayEPSS 2.3%CVE-2023-27585HIGHPJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior afEPSS 2.3%CVE-2023-41913CRITICALstrongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the intEPSS 2.3%CVE-2020-1654CRITICALJunos OS: SRX Series: processing a malformed HTTP message when ICAP redirect service is enabled may can lead to flowd process crash or remote code executionEPSS 2.2%CVE-2025-4348HIGHD-Link DIR-600L formSetWanL2TP buffer overflowEPSS 2.2%CVE-2022-41029HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 2.2%CVE-2022-41027HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 2.2%CVE-2021-31895HIGHA vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.7), RUGGEDCOM i801 (All versions < V4.3.7), RUGGEDCOM i802 (All vEPSS 2.2%CVE-2020-25185—The affected product is vulnerable to five post-authentication buffer overflows, which may allow a logged in user to remotely execute arbitrEPSS 2.2%CVE-2024-9909HIGHD-Link DIR-619L B1 formSetMuti buffer overflowEPSS 2.2%CVE-2024-39370CRITICALAn arbitrary code execution vulnerability exists in the adm.cgi set_MeshAp() functionality of Wavlink AC3000 M33A8.V5030.210505. A speciallyEPSS 2.2%CVE-2022-24793HIGHPotential heap buffer overflow when parsing DNS packets in PJSIPEPSS 2.2%CVE-2021-33719—A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variantsEPSS 2.2%