Fallos del tipo CWE-787

5142 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2022-47388HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47382HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2021-38684HIGHBuffer Overflow Vulnerability in Multimedia ConsoleEPSS 1.3%CVE-2022-47384HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47381HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47389HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47390HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2024-55884CRITICALIn the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausteEPSS 1.3%CVE-2023-40569MEDIUMOut-Of-Bounds Write in FreeRDPEPSS 1.3%CVE-2020-14386MEDIUMA flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes.EPSS 1.3%CVE-2021-1573HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Denial of Service VulnerabilityEPSS 1.3%CVE-2021-34704HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Denial of Service VulnerabilityEPSS 1.3%CVE-2024-42987HIGHTenda FH1206 v02.03.01.35 was discovered to contain a stack-based buffer overflow vulnerability in the fromPptpUserAdd function. The vulneraEPSS 1.3%CVE-2022-31901MEDIUMBuffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two craftEPSS 1.3%CVE-2023-22752CRITICALUnauthenticated Stack-Based Buffer Overflow Vulnerabilities in the PAPI ProtocolEPSS 1.3%CVE-2023-22751CRITICALUnauthenticated Stack-Based Buffer Overflow Vulnerabilities in the PAPI ProtocolEPSS 1.3%CVE-2023-24800CRITICALD-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_495220 function. This vulnerability allows attackers toEPSS 1.3%CVE-2021-46156—A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application EPSS 1.3%CVE-2021-46162—A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains an out of bounds write pastEPSS 1.3%CVE-2021-46161—A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application EPSS 1.3%