Fallos del tipo CWE-787

5846 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2022-36086HIGHlinked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`EPSS 0.9%CVE-2021-36493HIGHBuffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.EPSS 0.9%CVE-2022-44167HIGHTenda AC15 V15.03.05.18 is avulnerable to Buffer Overflow via function formSetPPTPServer.EPSS 0.9%CVE-2024-24186CRITICALJsish v3.5.0 (commit 42c694c) was discovered to contain a stack-overflow via the component IterGetKeysCallback at /jsish/src/jsiValue.c.EPSS 0.9%CVE-2022-40104HIGHTenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDget function. This vulnerability allows attackers to EPSS 0.9%CVE-2022-44163HIGHTenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.EPSS 0.9%CVE-2022-44169HIGHTenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer.EPSS 0.9%CVE-2022-44156HIGHTenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind.EPSS 0.9%CVE-2022-44158HIGHTenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.EPSS 0.9%CVE-2022-44168HIGHTenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function fromSetRouteStatic..EPSS 0.9%CVE-2020-36773CRITICALArtifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a singleEPSS 0.9%CVE-2022-40102HIGHTenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDset function. This vulnerability allows attackers to EPSS 0.9%CVE-2024-20039HIGHIn modem protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no aEPSS 0.9%CVE-2022-40648HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.9%CVE-2026-56211HIGHLibaom: libaom: remote code execution via svc layer context handling with attacker-controlled framesEPSS 0.9%CVE-2023-2854MEDIUMBLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileEPSS 0.9%CVE-2023-2857MEDIUMBLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileEPSS 0.9%CVE-2021-43814HIGHHeap-based OOB write when parsing dwarf DIE info in RizinEPSS 0.9%CVE-2022-23478CRITICALOut of Bound Write in xrdpEPSS 0.9%CVE-2022-45337HIGHTenda TX9 Pro v22.03.02.10 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind.EPSS 0.9%