Fallos del tipo CWE-129

324 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo que valores fora dos limites sejam usados. Isso pode causar leitura ou escrita de memória inválida, levando a crash, vazamento de dados ou execução de código arbitrário.

Ejemplo

Uma aplicação recebe um ID de usuário via parâmetro HTTP e o usa diretamente como índice em um array de sessões sem verificar se está dentro dos limites. Um atacante envia um índice negativo ou maior que o tamanho do array, acessando memória adjacente e roubando dados de outras sessões.

Cómo mitigar

Sempre validar que o índice está entre 0 e (tamanho_do_array - 1) antes de qualquer acesso. Use funções de linguagem que impõem limites automaticamente (como iteradores) ou implemente verificações explícitas com exceções/retorno de erro.

CVE-2024-21493MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a CaddyfileEPSS 0.7%CVE-2026-15685HIGHOllama downloadBlob Improper Validation of Array Index Denial-of-Service VulnerabilityEPSS 0.7%CVE-2023-26066CRITICALCertain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.EPSS 0.7%CVE-2024-0901HIGHSEGV and out of bounds memory read from malicious packetEPSS 0.7%CVE-2026-84445HIGHgRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS serversEPSS 0.7%CVE-2026-65653HIGHtemporalio/tchannel-go zero-chunk call fragment causes process terminationEPSS 0.7%CVE-2021-39985HIGHThe HwNearbyMain module has a Improper Validation of Array Index vulnerability.Successful exploitation of this vulnerability may cause a proEPSS 0.7%CVE-2024-29231MEDIUMImproper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 aEPSS 0.7%CVE-2026-56111HIGHMarlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code HandlerEPSS 0.6%CVE-2023-22408HIGHJunos OS: SRX 5000 Series: Upon processing of a specific SIP packet an FPC can crashEPSS 0.6%CVE-2025-21692HIGHnet: sched: fix ets qdisc OOB IndexingEPSS 0.6%CVE-2024-47249MEDIUMApache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handlerEPSS 0.6%CVE-2025-15271HIGHFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-15270HIGHFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-21522HIGHAll versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().EPSS 0.6%CVE-2023-22401HIGHJunos OS and Junos OS Evolved: PTX10008, PTX10016: When a specific SNMP MIB is queried the FPC will crashEPSS 0.6%CVE-2026-25882MEDIUMFiber has a Denial of Service Vulnerability via Route Parameter OverflowEPSS 0.6%CVE-2024-23084HIGHApfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(doubleEPSS 0.6%CVE-2025-69248MEDIUMfree5GC has Array Index Out of Bounds in AMF Leading to Denial of ServiceEPSS 0.6%CVE-2026-56770HIGHlibais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message IDEPSS 0.6%