Falhas do tipo CWE-119

3.506 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2025-4448HIGHD-Link DIR-619L formEasySetupWizard buffer overflowEPSS 3.0%CVE-2025-4450HIGHD-Link DIR-619L formSetEasy_Wizard buffer overflowEPSS 3.0%CVE-2025-4449HIGHD-Link DIR-619L formEasySetupWizard3 buffer overflowEPSS 3.0%CVE-2026-2910HIGHTenda HG9 formPing6 stack-based overflowEPSS 3.0%CVE-2021-30666HIGHA buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web cEPSS 3.0%KEVCVE-2017-12368—A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced RecEPSS 3.0%CVE-2017-12371—A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced RecEPSS 3.0%CVE-2017-12369—A "Cisco WebEx Network Recording Player Out-of-Bounds Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording FEPSS 3.0%CVE-2017-12370—A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced RecEPSS 3.0%CVE-2017-12372—A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced RecEPSS 3.0%CVE-2026-3808HIGHTenda FH1202 webtypelibrary formWebTypeLibrary stack-based overflowEPSS 3.0%CVE-2021-3570—A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a rEPSS 3.0%CVE-2025-15234HIGHTenda M3 setInternetLanInfo formSetRemoteInternetLanInfo heap-based overflowEPSS 2.9%CVE-2021-42781—Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the EPSS 2.9%CVE-2020-3146HIGHCisco RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Multiple VulnerabilitiesEPSS 2.9%CVE-2017-12367—A "Cisco WebEx Network Recording Player Denial of Service Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced RecordiEPSS 2.8%CVE-2026-6012HIGHD-Link DIR-513 POST Request formSetPassword buffer overflowEPSS 2.8%CVE-2017-3863—Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow EPSS 2.8%CVE-2021-42782—Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the liEPSS 2.8%CVE-2017-3862—Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow EPSS 2.8%