Fallos del tipo CWE-120

3164 resultados

Execução de código ou comandos não autorizados

Fraqueza em que a aplicação executa código ou comandos sem validar adequadamente a origem, permissões ou conteúdo fornecido por um atacante. O perigo está em permitir que um usuário sem privilégios execute operações restritas, como comandos do sistema, funções administrativas ou código arbitrário, comprometendo toda a segurança da aplicação.

Ejemplo

Um painel de controle que permite ao usuário executar scripts de manutenção sem autenticação apropriada, ou uma função que passa entrada do usuário diretamente para eval() em Python/JavaScript, permitindo injeção de código malicioso que roda com as permissões da aplicação.

Cómo mitigar

Implemente validação rigorosa de entrada, use allowlists (não blacklists), mantenha controle de acesso baseado em roles (RBAC) com verificação em cada operação sensível, e evite construtores dinâmicos como eval(). Quando precisar executar comandos do sistema, use APIs seguras e nunca passe entrada do usuário sem sanitização completa.

CVE-2025-10120HIGHTenda AC20 GetParentControlInfo strcpy buffer overflowEPSS 0.8%CVE-2025-5629HIGHTenda AC10 HTTP SetPptpServerCfg formSetPPTPServer buffer overflowEPSS 0.8%CVE-2020-9247—There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parametEPSS 0.8%CVE-2025-5408CRITICALWAVLINK WL-WN576K1 HTTP POST Request login.cgi sys_login buffer overflowEPSS 0.8%CVE-2023-33457HIGHIn Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash.EPSS 0.8%CVE-2024-5243HIGHTP-Link Omada ER605 Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-51888HIGHBuffer Overflow vulnerability in the nomath() function in Mathtex v.1.05 and before allows a remote attacker to cause a denial of service viEPSS 0.8%CVE-2023-51886HIGHBuffer Overflow vulnerability in the main() function in Mathtex 1.05 and before allows a remote attacker to cause a denial of service when uEPSS 0.8%CVE-2025-12622HIGHTenda AC10 SysRunCmd formSysRunCmd buffer overflowEPSS 0.8%CVE-2022-45671HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the appData parameter in the formSetAppFilterRule function.EPSS 0.8%CVE-2022-45663HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function.EPSS 0.8%CVE-2022-45660HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedStartTime parameter in the setSchedWifi function.EPSS 0.8%CVE-2022-45647HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeed parameter in the formSetClientState function.EPSS 0.8%CVE-2022-45656HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function.EPSS 0.8%CVE-2022-45646HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeedUp parameter in the formSetClientState function.EPSS 0.8%CVE-2026-9698HIGHDBI versions before 1.648 for Perl saved errors in a limited-sized bufferEPSS 0.8%CVE-2022-45653HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the page parameter in the fromNatStaticSetting function.EPSS 0.8%CVE-2022-45650HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the firewallEn parameter in the formSetFirewallCfg function.EPSS 0.8%CVE-2022-45648HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the devName parameter in the formSetDeviceName function.EPSS 0.8%CVE-2022-45655HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the timeZone parameter in the form_fast_setting_wifi_set functionEPSS 0.8%