Fallos del tipo CWE-787

5145 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2023-33638HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.EPSS 0.9%CVE-2023-33637HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm.EPSS 0.9%CVE-2023-33631HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelSTList interface at /goform/aspForm.EPSS 0.9%CVE-2023-33641HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm.EPSS 0.9%CVE-2023-33636HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspFoEPSS 0.9%CVE-2023-33642HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.EPSS 0.9%CVE-2023-33634HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm.EPSS 0.9%CVE-2023-33627HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.EPSS 0.9%CVE-2023-33640HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspEPSS 0.9%CVE-2023-33635HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.EPSS 0.9%CVE-2026-21413CRITICALA heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. AEPSS 0.9%CVE-2022-23566HIGHOut of bounds write in TensorflowEPSS 0.9%CVE-2024-38439CRITICALNetatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginEPSS 0.9%CVE-2025-62164HIGHVLLM deserialization vulnerability leading to DoS and potential RCEEPSS 0.9%CVE-2023-5168CRITICALA compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potenEPSS 0.9%CVE-2022-48078CRITICALpycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode.EPSS 0.9%CVE-2023-2072HIGHRockwell Automation PowerMonitor 1000 Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2021-28816HIGHStack Buffer Overflow Vulnerabilities in QTS, QuTS hero, and QuTScloudEPSS 0.9%CVE-2022-48130CRITICALTenda W20E v15.11.0.6 was discovered to contain multiple stack overflows in the function formSetStaticRoute via the parameters staticRouteNeEPSS 0.9%CVE-2023-26805CRITICALTenda W20E v15.11.0.6 (US_W20EV4.0br_v15.11.0.6(1068_1546_841)_CN_TDC) is vulnerable to Buffer Overflow via function formIPMacBindModify.EPSS 0.9%