Fallos del tipo CWE-120

3169 resultados

Execução de código ou comandos não autorizados

Fraqueza em que a aplicação executa código ou comandos sem validar adequadamente a origem, permissões ou conteúdo fornecido por um atacante. O perigo está em permitir que um usuário sem privilégios execute operações restritas, como comandos do sistema, funções administrativas ou código arbitrário, comprometendo toda a segurança da aplicação.

Ejemplo

Um painel de controle que permite ao usuário executar scripts de manutenção sem autenticação apropriada, ou uma função que passa entrada do usuário diretamente para eval() em Python/JavaScript, permitindo injeção de código malicioso que roda com as permissões da aplicação.

Cómo mitigar

Implemente validação rigorosa de entrada, use allowlists (não blacklists), mantenha controle de acesso baseado em roles (RBAC) com verificação em cada operação sensível, e evite construtores dinâmicos como eval(). Quando precisar executar comandos do sistema, use APIs seguras e nunca passe entrada do usuário sem sanitização completa.

CVE-2023-28741HIGHBuffer overflow in some Intel(R) QAT drivers for Windows - HW Version 1.0 before version 1.10 may allow an authenticated user to potentiallyEPSS 0.2%CVE-2025-9557HIGHBluetooth: Mesh: Out-of-Bound Write in gen_prov_contEPSS 0.2%CVE-2022-26414MEDIUMA potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, wEPSS 0.2%CVE-2026-90801MEDIUMGNU Binutils ld cache.c cache_bwrite buffer overflowEPSS 0.2%CVE-2024-9997HIGHAutodesk AutoCAD DWG File Parsing Memory Corruption Code Execution VulnerabilityEPSS 0.2%CVE-2024-8592HIGHAutodesk AutoCAD CATPART File Parsing Memory Corruption Code Execution VulnerabilityEPSS 0.2%CVE-2026-71612HIGHBuffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmx_EPSS 0.2%CVE-2026-84581HIGHA buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe EPSS 0.2%CVE-2025-50361MEDIUMBuffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db36451e90a0ac74bcc5593feEPSS 0.2%CVE-2023-22661HIGHBuffer overflow in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilegeEPSS 0.2%CVE-2024-6199HIGHUnauthenticated Remote Code ExecutionEPSS 0.2%CVE-2026-24344HIGHMultiple Buffer Overflows in EZCast Pro II DongleEPSS 0.2%CVE-2024-23079MEDIUMJGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compaEPSS 0.2%CVE-2024-44157MEDIUMA stack buffer overflow was addressed through improved input validation. This issue is fixed in Apple TV 1.5.0.152 for Windows, iTunes 12.13EPSS 0.2%CVE-2025-12440MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage inEPSS 0.2%CVE-2025-57571MEDIUMTenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow. via the macFilterList parameter in goform/setNAT.EPSS 0.2%CVE-2025-57569MEDIUMTenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the portList parameter in /goform/setNAT.EPSS 0.2%CVE-2025-57570MEDIUMTenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the QosList parameter in goform/setQoS.EPSS 0.2%CVE-2026-6694MEDIUMGimp: gimp file-png plugin: denial of service via oversized apng trns chunkEPSS 0.2%CVE-2022-1110MEDIUMA buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of serEPSS 0.2%