Fallos del tipo CWE-787

5106 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2022-28829HIGHAdobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-30662HIGHAdobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-30656HIGHAdobe InCopy PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-28821HIGHAdobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-30652HIGHAdobe InCopy SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-30659HIGHAdobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-28822HIGHAdobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-28826HIGHAdobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-30653HIGHAdobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-30665HIGHAdobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-28825HIGHAdobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 2.1%CVE-2021-46645HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2021-46644HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2021-46639HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2021-46646HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. UEPSS 2.1%CVE-2021-46640HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2021-46652HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction EPSS 2.1%CVE-2024-11236CRITICALInteger overflow in the firebird and dblib quoters causing OOB writesEPSS 2.1%CVE-2023-33476CRITICALReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validationEPSS 2.1%CVE-2024-29131HIGHApache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()EPSS 2.1%