Fallos del tipo CWE-787

5133 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2023-28879CRITICALIn Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpEPSS 6.3%CVE-2017-2640HIGHAn out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially useEPSS 6.3%CVE-2024-37894MEDIUMSquid vulnerable to heap corruption in ESI assignEPSS 6.3%CVE-2019-3856HIGHAn integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requEPSS 6.1%CVE-2019-3857HIGHAn integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUESEPSS 6.1%CVE-2022-20968HIGHA vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthentiEPSS 6.1%CVE-2020-8848HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interactionEPSS 6.1%CVE-2020-8847HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interactionEPSS 6.1%CVE-2020-8854HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interacEPSS 6.1%CVE-2020-8853HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interacEPSS 6.0%CVE-2020-8849HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interactionEPSS 6.0%CVE-2020-8850HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interactionEPSS 6.0%CVE-2020-8851HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interactionEPSS 6.0%CVE-2024-30279HIGHZDI-CAN-22887: Adobe Acrobat Reader DC JPEG2000 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 5.9%CVE-2024-9143MEDIUMLow-level invalid GF(2^m) parameters lead to OOB memory accessEPSS 5.8%CVE-2019-17139HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interacEPSS 5.8%CVE-2021-21099HIGHAdobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code executionEPSS 5.8%CVE-2021-21098HIGHAdobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code executionEPSS 5.8%CVE-2022-45460CRITICALMultiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.0000EPSS 5.7%CVE-2026-53413HIGHZoom Clients - Buffer Over-writeEPSS 5.6%