Fallos del tipo CWE-787

5846 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em uma posição de memória fora do intervalo alocado para um buffer, array ou estrutura. O atacante aproveita para sobrescrever dados adjacentes (variáveis, ponteiros, pilha de retorno), alterando o comportamento da aplicação ou assumindo controle total do sistema.

Ejemplo

Um programa lê 256 bytes de entrada do usuário e copia para um buffer de 64 bytes sem validação. O atacante envia 300 bytes, que transbordam o buffer e sobrescrevem o endereço de retorno na pilha, permitindo execução de código arbitrário.

Cómo mitigar

Sempre validar tamanho de entrada contra o limite do buffer antes de copiar (usar strncpy, snprintf em vez de strcpy, sprintf). Em linguagens modernas, usar estruturas bounds-checked (Rust, C# arrays) ou linters que detectem padrões perigosos.

CVE-2024-32672MEDIUMA Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of serEPSS 0.8%CVE-2026-72098CRITICALdm-verity: fix buffer overflow in FEC calculationEPSS 0.8%CVE-2023-20520CRITICALImproper access control settings in ASP Bootloader may allow an attacker to corrupt the return address causing a stack-based buffer overrun EPSS 0.8%CVE-2026-70197HIGH.NET and Visual Studio Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-27804MEDIUMH3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm. This vulnerabilitEPSS 0.8%CVE-2023-29914MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.EPSS 0.8%CVE-2023-29916MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm.EPSS 0.8%CVE-2023-29906MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.EPSS 0.8%CVE-2022-37355HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reEPSS 0.8%CVE-2023-27810MEDIUMH3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm. This vEPSS 0.8%CVE-2023-29917MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via go parameter at /goform/aspForm.EPSS 0.8%CVE-2023-29905MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.EPSS 0.8%CVE-2022-37356HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reEPSS 0.8%CVE-2023-29913MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm.EPSS 0.8%CVE-2023-27802MEDIUMH3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EditvsList parameter at /goform/aspForm. This vulnerabiliEPSS 0.8%CVE-2023-29910MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.EPSS 0.8%CVE-2023-29907MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.EPSS 0.8%CVE-2023-24613MEDIUMThe user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb tool to overwrite theEPSS 0.8%CVE-2023-29915MEDIUMH3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm.EPSS 0.8%CVE-2023-27807MEDIUMH3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm. This vulnerabilitEPSS 0.8%