Fallos del tipo CWE-822

247 resultados

Desreferência de ponteiro não validado

O código desreferenceia um ponteiro (acessa o valor apontado) sem validar se ele é válido ou confiável. Um atacante pode fornecer um endereço de memória malformado ou controlado, causando crash, corrupção de dados ou execução de código arbitrário.

Ejemplo

Um programa recebe um endereço de memória de uma entrada externa (arquivo, rede, argumento do usuário) e imediatamente o usa como ponteiro sem verificar se o endereço é seguro ou se aponta para memória alocada válida. Resultado: acesso a memória inválida.

Cómo mitigar

Sempre validar ponteiros antes de desreferenciar — verificar null, confirmar que apontam para memória alocada pelo programa e, se possível, usar estruturas seguras (smart pointers em C++, bounds checking em C). Evitar aceitar ponteiros diretos de entrada não confiável; prefira índices ou offsets que sejam validados.

CVE-2020-27259—Omron CX-OneEPSS 2.7%CVE-2018-7497—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 2.5%CVE-2021-22649—Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1EPSS 2.2%CVE-2020-27277—Delta Electronics DOPSoft Version 4.0.8.21 and prior has a null pointer dereference issue while processing project files, which may allow anEPSS 2.2%CVE-2024-20680MEDIUMWindows Message Queuing Client (MSMQC) Information DisclosureEPSS 2.0%CVE-2023-36596HIGHRemote Procedure Call Information Disclosure VulnerabilityEPSS 2.0%CVE-2021-27496—Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior EPSS 2.0%CVE-2024-20664MEDIUMMicrosoft Message Queuing Information Disclosure VulnerabilityEPSS 2.0%CVE-2024-30090HIGHMicrosoft Streaming Service Elevation of Privilege VulnerabilityEPSS 2.0%CVE-2023-21677HIGHWindows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityEPSS 2.0%CVE-2017-16728—An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple vulnerabilities that EPSS 1.9%CVE-2024-20663MEDIUMWindows Message Queuing Client (MSMQC) Information DisclosureEPSS 1.9%CVE-2020-27289—Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a null pointer dereference issue while processing project files, which may allow EPSS 1.9%CVE-2024-43624HIGHWindows Hyper-V Shared Virtual Disk Elevation of Privilege VulnerabilityEPSS 1.8%CVE-2024-38104HIGHWindows Fax Service Remote Code Execution VulnerabilityEPSS 1.8%CVE-2025-60719HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 1.8%CVE-2024-37339HIGHMicrosoft SQL Server Native Scoring Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-37340HIGHMicrosoft SQL Server Native Scoring Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-31481HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31504HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (pEPSS 1.4%