Falhas do tipo CWE-119

3.506 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2020-3268HIGHCisco Small Business RV110W, RV130, RV130W, and RV215W Series Routers Management Interface VulnerabilitiesEPSS 2.6%CVE-2018-10490—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.6%CVE-2017-12280—A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) Discovery Request parsing functionality of Cisco WirelessEPSS 2.6%CVE-2020-12038—Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6EPSS 2.6%CVE-2026-7082HIGHTenda F456 httpd WrlExtraSet formWrlExtraSet buffer overflowEPSS 2.6%CVE-2026-5204HIGHTenda CH22 Parameter webtypelibrary formWebTypeLibrary stack-based overflowEPSS 2.5%CVE-2017-2668MEDIUM389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled.EPSS 2.5%CVE-2020-7554—A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version EPSS 2.5%CVE-2020-7550—A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version EPSS 2.5%CVE-2021-21950CRITICALAn out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker EufEPSS 2.5%CVE-2021-21951CRITICALAn out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker EufEPSS 2.5%CVE-2025-4348HIGHD-Link DIR-600L formSetWanL2TP buffer overflowEPSS 2.5%CVE-2017-3808—A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager (Cisco Unified CM) cEPSS 2.5%CVE-2021-22714—A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION7400, PM8000 and IONEPSS 2.4%CVE-2025-4347HIGHD-Link DIR-600L formWlSiteSurvey buffer overflowEPSS 2.4%CVE-2025-13188CRITICALD-Link DIR-816L authentication.cgi authenticationcgi_main stack-based overflowEPSS 2.4%CVE-2026-86296CRITICALD-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflowEPSS 2.4%CVE-2018-4344HIGHA memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOEPSS 2.4%KEVCVE-2018-14320—This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is requEPSS 2.4%CVE-2018-0204—A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to creaEPSS 2.3%