Fallos del tipo CWE-120

3164 resultados

Execução de código ou comandos não autorizados

Fraqueza em que a aplicação executa código ou comandos sem validar adequadamente a origem, permissões ou conteúdo fornecido por um atacante. O perigo está em permitir que um usuário sem privilégios execute operações restritas, como comandos do sistema, funções administrativas ou código arbitrário, comprometendo toda a segurança da aplicação.

Ejemplo

Um painel de controle que permite ao usuário executar scripts de manutenção sem autenticação apropriada, ou uma função que passa entrada do usuário diretamente para eval() em Python/JavaScript, permitindo injeção de código malicioso que roda com as permissões da aplicação.

Cómo mitigar

Implemente validação rigorosa de entrada, use allowlists (não blacklists), mantenha controle de acesso baseado em roles (RBAC) com verificação em cada operação sensível, e evite construtores dinâmicos como eval(). Quando precisar executar comandos do sistema, use APIs seguras e nunca passe entrada do usuário sem sanitização completa.

CVE-2022-40985HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.6%CVE-2021-33226CRITICALBuffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/moEPSS 1.6%CVE-2022-31019HIGHDoS Vulnerability in URLEncodedFormDecoder in VaporEPSS 1.6%CVE-2023-46012CRITICALBuffer Overflow vulnerability LINKSYS EA7500 3.0.1.207964 allows a remote attacker to execute arbitrary code via an HTTP request to the IGD EPSS 1.6%CVE-2025-4871MEDIUMPCMan FTP Server REST Command buffer overflowEPSS 1.6%CVE-2019-11851CRITICALThe ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows rEPSS 1.6%CVE-2021-33537HIGHWEIDMUELLER: WLAN devices affected by Remote Code Execution (RCE) vulnerabilityEPSS 1.6%CVE-2022-32504CRITICALAn issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service EPSS 1.6%CVE-2021-20236—A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the EPSS 1.6%CVE-2025-69259HIGHA message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service EPSS 1.6%CVE-2025-69260HIGHA message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service conditionEPSS 1.6%CVE-2022-22683CRITICALBuffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-EPSS 1.6%CVE-2023-21517HIGHHeap out-of-bound write vulnerability in Exynos baseband prior to SMR Jun-2023 Release 1 allows remote attacker to execute arbitrary code.EPSS 1.6%CVE-2025-8169HIGHD-Link DIR-513 HTTP POST Request formSetWanPPTPpath formSetWanPPTPcallback buffer overflowEPSS 1.6%CVE-2021-21939CRITICALA heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can EPSS 1.6%CVE-2025-4149HIGHNetgear EX6200 sub_54014 buffer overflowEPSS 1.6%CVE-2025-4148HIGHNetgear EX6200 sub_503FC buffer overflowEPSS 1.6%CVE-2024-9535HIGHD-Link DIR-605L formEasySetupWWConfig buffer overflowEPSS 1.6%CVE-2024-9786HIGHD-Link DIR-619L B1 formSetLog buffer overflowEPSS 1.6%CVE-2022-39274HIGHBuffer Overflow in `ProcessRadioRxDone` in LoRaMac-nodeEPSS 1.6%