Fallos del tipo CWE-120

3164 resultados

Execução de código ou comandos não autorizados

Fraqueza em que a aplicação executa código ou comandos sem validar adequadamente a origem, permissões ou conteúdo fornecido por um atacante. O perigo está em permitir que um usuário sem privilégios execute operações restritas, como comandos do sistema, funções administrativas ou código arbitrário, comprometendo toda a segurança da aplicação.

Ejemplo

Um painel de controle que permite ao usuário executar scripts de manutenção sem autenticação apropriada, ou uma função que passa entrada do usuário diretamente para eval() em Python/JavaScript, permitindo injeção de código malicioso que roda com as permissões da aplicação.

Cómo mitigar

Implemente validação rigorosa de entrada, use allowlists (não blacklists), mantenha controle de acesso baseado em roles (RBAC) com verificação em cada operação sensível, e evite construtores dinâmicos como eval(). Quando precisar executar comandos do sistema, use APIs seguras e nunca passe entrada do usuário sem sanitização completa.

CVE-2026-7248CRITICALD-Link DI-8100 CGI Endpoint tgfile.htm tgfile_htm buffer overflowEPSS 2.2%CVE-2020-8261—A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.EPSS 2.2%CVE-2025-4347HIGHD-Link DIR-600L formWlSiteSurvey buffer overflowEPSS 2.2%CVE-2022-39344CRITICALAzure RTOS USBX vulnerable to buffer overflow EPSS 2.1%CVE-2024-7832HIGHD-Link DNS-1550-04 photocenter_mgr.cgi cgi_get_fullscreen_photos buffer overflowEPSS 2.1%CVE-2023-45614CRITICALThere are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending EPSS 2.1%CVE-2023-22779CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22786CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2022-29189MEDIUMBuffer for inbound DTLS fragments has no limitEPSS 2.1%CVE-2022-24754HIGHBuffer overflow in pjsipEPSS 2.1%CVE-2023-3346CRITICALDenial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC SeriesEPSS 2.1%CVE-2022-31414HIGHD-Link DIR-1960 firmware DIR-1960_A1_1.11 was discovered to contain a buffer overflow via srtcat in prog.cgi. This vulnerability allowed attEPSS 2.1%CVE-2023-22780CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22781CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22783CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22784CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22785CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22782CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2022-35927HIGHUnverified DIO prefix info lengths in RPL-Classic in Contiki-NGEPSS 2.1%CVE-2025-55847HIGHWavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises becauseEPSS 2.0%