Fallos del tipo CWE-787

5145 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2024-12547HIGHTungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-5717HIGHOut-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) componentEPSS 0.8%CVE-2024-29218HIGHOut-of-bounds write vulnerability exists in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.EPSS 0.8%CVE-2024-3157HIGHOut of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU prEPSS 0.8%CVE-2022-1238HIGHOut-of-bounds Write in libr/bin/format/ne/ne.c in radareorg/radare2EPSS 0.8%CVE-2021-43814HIGHHeap-based OOB write when parsing dwarf DIE info in RizinEPSS 0.8%CVE-2023-30372CRITICALIn Tenda AC15 V15.03.05.19, The function "xkjs_ver32" contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-30373CRITICALIn Tenda AC15 V15.03.05.19, the function "xian_pppoe_user" contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-34613HIGHAn issue was discovered sojo thru 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uEPSS 0.8%CVE-2023-30370CRITICALIn Tenda AC15 V15.03.05.19, the function GetValue contains a stack-based buffer overflow vulnerability.EPSS 0.8%CVE-2023-34614HIGHAn issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted obEPSS 0.8%CVE-2022-23560HIGHRead and Write outside of bounds in TFLiteEPSS 0.8%CVE-2022-23574HIGHOut of bounds read and write in TensorflowEPSS 0.8%CVE-2022-23478CRITICALOut of Bound Write in xrdpEPSS 0.8%CVE-2022-3043HIGHHeap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user tEPSS 0.8%CVE-2023-32886HIGHIn Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service withEPSS 0.8%CVE-2026-82680HIGHD-Link DSM-G600 Multipart load_file.cgi out-of-bounds writeEPSS 0.8%CVE-2023-1801—The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet.EPSS 0.8%CVE-2021-22791MEDIUMA CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating thEPSS 0.8%CVE-2023-27239CRITICALTenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the shareSpeed parameter at /goform/WifiGuestSet.EPSS 0.8%