Fallos del tipo CWE-787

5843 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2022-41742HIGHNGINX ngx_http_mp4_module vulnerability CVE-2022-41742EPSS 1.2%CVE-2023-25283HIGHA stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1EPSS 1.2%CVE-2022-44187CRITICALNetgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via wan_dns1_pri.EPSS 1.2%CVE-2022-44186CRITICALNetgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_pri.EPSS 1.2%CVE-2022-44188CRITICALNetgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter enable_band_steering.EPSS 1.2%CVE-2022-44190CRITICALNetgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter enable_band_steering.EPSS 1.2%CVE-2024-21661HIGHArgo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded EnvironmentEPSS 1.2%CVE-2023-34609HIGHAn issue was discovered flexjson thru 3.3 allows attackers to cause a denial of service or other unspecified impacts via crafted object thatEPSS 1.2%CVE-2022-40854CRITICALTenda AC18 router contained a stack overflow vulnerability in /goform/fast_setting_wifi_setEPSS 1.2%CVE-2022-40868CRITICALTenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formDeEPSS 1.2%CVE-2022-40853CRITICALTenda AC15 router V15.03.05.19 contains a stack overflow via the list parameter at /goform/fast_setting_wifi_setEPSS 1.2%CVE-2022-40866CRITICALTenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formSeEPSS 1.2%CVE-2022-40867CRITICALTenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formIPEPSS 1.2%CVE-2022-40860CRITICALTenda AC15 router V15.03.05.19 contains a stack overflow vulnerability in the function formSetQosBand->FUN_0007dd20 with request /goform/SetEPSS 1.2%CVE-2021-22752—A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data orEPSS 1.2%CVE-2021-22754—A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data orEPSS 1.2%CVE-2021-22750—A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21041 and prior that could result in loss of data orEPSS 1.2%CVE-2023-49355HIGHdecToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. NOTE: this is notEPSS 1.2%CVE-2024-12648CRITICALBuffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker onEPSS 1.2%CVE-2022-44193CRITICALNetgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameters: starthour, startminute , endhour, and endminuteEPSS 1.2%