Falhas do tipo CWE-119

3.263 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2017-12371—A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced RecEPSS 3.0%CVE-2021-3570—A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a rEPSS 3.0%CVE-2018-4344HIGHA memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOEPSS 2.9%KEVCVE-2021-42781—Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the EPSS 2.9%CVE-2025-4448HIGHD-Link DIR-619L formEasySetupWizard buffer overflowEPSS 2.9%CVE-2025-4450HIGHD-Link DIR-619L formSetEasy_Wizard buffer overflowEPSS 2.9%CVE-2025-4451HIGHD-Link DIR-619L formSetWAN_Wizard52 buffer overflowEPSS 2.9%CVE-2025-4449HIGHD-Link DIR-619L formEasySetupWizard3 buffer overflowEPSS 2.9%CVE-2025-4452HIGHD-Link DIR-619L formSetWizard2 buffer overflowEPSS 2.9%CVE-2025-5228HIGHD-Link DI-8100 jhttpd login.cgi httpd_get_parm stack-based overflowEPSS 2.9%CVE-2020-3146HIGHCisco RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Multiple VulnerabilitiesEPSS 2.9%CVE-2017-12367—A "Cisco WebEx Network Recording Player Denial of Service Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced RecordiEPSS 2.8%CVE-2025-15234HIGHTenda M3 setInternetLanInfo formSetRemoteInternetLanInfo heap-based overflowEPSS 2.8%CVE-2017-3862—Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow EPSS 2.8%CVE-2017-3860—Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow EPSS 2.8%CVE-2021-42782—Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the liEPSS 2.8%CVE-2017-3861—Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow EPSS 2.8%CVE-2017-3863—Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow EPSS 2.8%CVE-2025-6121CRITICALD-Link DIR-632 HTTP POST Request get_pure_content stack-based overflowEPSS 2.8%CVE-2021-21899HIGHA code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A speEPSS 2.8%