Falhas do tipo CWE-119

3.263 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2020-3286HIGHCisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution VulnerabilitiesEPSS 3.2%CVE-2020-3287HIGHCisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution VulnerabilitiesEPSS 3.2%CVE-2020-3293HIGHCisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution VulnerabilitiesEPSS 3.2%CVE-2020-3290HIGHCisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution VulnerabilitiesEPSS 3.2%CVE-2020-3292HIGHCisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution VulnerabilitiesEPSS 3.2%CVE-2020-3296HIGHCisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution VulnerabilitiesEPSS 3.2%CVE-2020-3294HIGHCisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution VulnerabilitiesEPSS 3.2%CVE-2020-3291HIGHCisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution VulnerabilitiesEPSS 3.2%CVE-2020-3289HIGHCisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution VulnerabilitiesEPSS 3.2%CVE-2025-24132MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An atEPSS 3.2%CVE-2026-2911HIGHTenda FH451 GstDhcpSetSer buffer overflowEPSS 3.1%CVE-2025-7795HIGHTenda FH451 P2pListFilter fromP2pListFilter stack-based overflowEPSS 3.1%CVE-2020-3453MEDIUMCisco Small Business RV340 Series Routers Command Injection and Remote Code Execution VulnerabilitiesEPSS 3.1%CVE-2021-40393CRITICALAn out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5EPSS 3.1%CVE-2021-1459CRITICALCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution VulnerabilityEPSS 3.0%CVE-2021-30666HIGHA buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web cEPSS 3.0%KEVCVE-2017-12372—A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced RecEPSS 3.0%CVE-2017-12368—A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced RecEPSS 3.0%CVE-2017-12370—A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced RecEPSS 3.0%CVE-2017-12369—A "Cisco WebEx Network Recording Player Out-of-Bounds Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording FEPSS 3.0%