Fallos del tipo CWE-120

3164 resultados

Execução de código ou comandos não autorizados

Fraqueza em que a aplicação executa código ou comandos sem validar adequadamente a origem, permissões ou conteúdo fornecido por um atacante. O perigo está em permitir que um usuário sem privilégios execute operações restritas, como comandos do sistema, funções administrativas ou código arbitrário, comprometendo toda a segurança da aplicação.

Ejemplo

Um painel de controle que permite ao usuário executar scripts de manutenção sem autenticação apropriada, ou uma função que passa entrada do usuário diretamente para eval() em Python/JavaScript, permitindo injeção de código malicioso que roda com as permissões da aplicação.

Cómo mitigar

Implemente validação rigorosa de entrada, use allowlists (não blacklists), mantenha controle de acesso baseado em roles (RBAC) com verificação em cada operação sensível, e evite construtores dinâmicos como eval(). Quando precisar executar comandos do sistema, use APIs seguras e nunca passe entrada do usuário sem sanitização completa.

CVE-2026-75438HIGHBuffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() functionEPSS 0.8%CVE-2026-67869HIGHBuffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates inputEPSS 0.8%CVE-2021-3555HIGHA Buffer Overflow vulnerability in the RSTP server component of Eufy Indoor 2K Indoor Camera allows a local attacker to achieve remote code EPSS 0.8%CVE-2024-46292HIGHA buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name paraEPSS 0.8%CVE-2025-7460HIGHTOTOLINK T6 HTTP POST Request cstecgi.cgi setWiFiAclRules buffer overflowEPSS 0.8%CVE-2020-7877HIGHZOOK solution(remote administration tool) buffer overflow vulnerabilityEPSS 0.8%CVE-2024-29243CRITICALShenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the vpn_client_ip parameter at /apEPSS 0.8%CVE-2024-30620CRITICALTenda AX1803 v1.0.0.1 contains a stack overflow via the serviceName parameter in the function fromAdvSetMacMtuWan.EPSS 0.8%CVE-2018-25237CRITICALHirschmann HiSecOS Buffer Overflow via HTTPS LoginEPSS 0.8%CVE-2022-46544HIGHTenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the cmdinput parameter at /goform/exeCommand.EPSS 0.8%CVE-2025-7468HIGHTenda FH1201 HTTP POST Request fromSafeUrlFilter buffer overflowEPSS 0.8%CVE-2022-46548HIGHTenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/DhcpListClient.EPSS 0.8%CVE-2022-46542HIGHTenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/addressNat.EPSS 0.8%CVE-2022-46540HIGHTenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/addressNat.EPSS 0.8%CVE-2022-46530HIGHTenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mac parameter at /goform/GetParentControlInfo.EPSS 0.8%CVE-2022-46537HIGHTenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security parameter at /goform/WifiBasicSet.EPSS 0.8%CVE-2022-46534HIGHTenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the speed_dir parameter at /goform/SetSpeedWan.EPSS 0.8%CVE-2023-36359HIGHTP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR940N V2/V3 and TL-WR941ND V5/V6 were discovered to contain a buffer overflow in the component /EPSS 0.8%CVE-2022-45665HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.EPSS 0.8%CVE-2022-46531HIGHTenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/addWifiMacFilter.EPSS 0.8%