Fallos del tipo CWE-787

5142 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2021-32998HIGHThe FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbEPSS 1.2%CVE-2023-25283HIGHA stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1EPSS 1.2%CVE-2024-12648CRITICALBuffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker onEPSS 1.2%CVE-2024-21661HIGHArgo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded EnvironmentEPSS 1.2%CVE-2023-34609HIGHAn issue was discovered flexjson thru 3.3 allows attackers to cause a denial of service or other unspecified impacts via crafted object thatEPSS 1.2%CVE-2021-22752—A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data orEPSS 1.2%CVE-2021-22754—A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data orEPSS 1.2%CVE-2021-22750—A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21041 and prior that could result in loss of data orEPSS 1.2%CVE-2023-49355HIGHdecToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. NOTE: this is notEPSS 1.2%CVE-2021-44005—A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_LoadeEPSS 1.2%CVE-2026-85437CRITICALMOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String DecodersEPSS 1.2%CVE-2021-44006—A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_LoadeEPSS 1.2%CVE-2022-40008CRITICALSWFTools commit 772e55a was discovered to contain a heap-buffer overflow via the function readU8 at /lib/ttf.c.EPSS 1.2%CVE-2019-12810—A memory corruption vulnerability exists in the .PSD parsing functionality of ALSee v5.3 ~ v8.39. A specially crafted .PSD file can cause anEPSS 1.2%CVE-2022-46393CRITICALAn issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffeEPSS 1.2%CVE-2022-3045HIGHInsufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heEPSS 1.2%CVE-2023-37712CRITICALTenda AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408) were discovered to contain a stack overflow in the page parameterEPSS 1.2%CVE-2020-25171—Fuji Electric V-Server LiteEPSS 1.2%CVE-2023-4154HIGHSamba: ad dc password exposure to privileged users and rodcsEPSS 1.2%CVE-2022-40868CRITICALTenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formDeEPSS 1.1%