Fallos del tipo CWE-787

5102 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2022-44253HIGHTOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function.EPSS 2.1%CVE-2021-46583HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2021-34914HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34897HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-34903HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-46604HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2018-17927—In Delta Industrial Automation TPEditor, TPEditor Versions 1.90 and prior, multiple out-of-bounds write vulnerabilities may be exploited by EPSS 2.1%CVE-2023-6816CRITICALXorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointerEPSS 2.1%CVE-2023-21609HIGHAdobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2023-26395HIGHAdobe Acrobat parsing PDF Out-of-bounds Write Arbitrary code execution EPSS 2.1%CVE-2019-11772—In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null EPSS 2.1%CVE-2021-46586HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2021-46584HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2023-33669CRITICALTenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c function.EPSS 2.1%CVE-2022-30662HIGHAdobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-30656HIGHAdobe InCopy PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-30653HIGHAdobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-30660HIGHAdobe InDesign PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-30652HIGHAdobe InCopy SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-30659HIGHAdobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%