Fallos del tipo CWE-129

287 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo que valores fora dos limites sejam usados. Isso pode causar leitura ou escrita de memória inválida, levando a crash, vazamento de dados ou execução de código arbitrário.

Ejemplo

Uma aplicação recebe um ID de usuário via parâmetro HTTP e o usa diretamente como índice em um array de sessões sem verificar se está dentro dos limites. Um atacante envia um índice negativo ou maior que o tamanho do array, acessando memória adjacente e roubando dados de outras sessões.

Cómo mitigar

Sempre validar que o índice está entre 0 e (tamanho_do_array - 1) antes de qualquer acesso. Use funções de linguagem que impõem limites automaticamente (como iteradores) ou implemente verificações explícitas com exceções/retorno de erro.

CVE-2023-40477HIGHRARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 12.3%CVE-2023-0755CRITICAL The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remoteEPSS 11.8%CVE-2023-46724HIGHSQUID-2023:4 Denial of Service in SSL Certificate validationEPSS 4.0%CVE-2005-0369MEDIUMArmagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 earlier allows remote attackers to cause a denial of service (application craEPSS 3.5%CVE-2020-10071CRITICALInsufficient publish message length validation in MQTTEPSS 3.4%CVE-2020-35636CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_pEPSS 3.3%CVE-2022-48503HIGHThe issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS MontereyEPSS 3.2%KEVCVE-2020-28601CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.9%CVE-2020-35628CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.9%CVE-2020-28636CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.9%CVE-2020-25792HIGHAn issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when coEPSS 2.8%CVE-2019-1837MEDIUMCisco Unified Communications Manager Denial of Service VulnerabilityEPSS 2.4%CVE-2020-35634CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.4%CVE-2020-35635CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_pEPSS 2.4%CVE-2020-35633CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.3%CVE-2020-28623CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28617CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28615CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28620CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28616CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%