Falhas do tipo CWE-119

3.263 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2025-3618HIGHLocal Privilege Escalation VulnerabilityEPSS 1.8%CVE-2019-1892HIGHCisco Small Business Series Switches Memory Corruption VulnerabilityEPSS 1.8%CVE-2019-12673HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Denial of Service VulnerabilityEPSS 1.8%CVE-2021-3498—GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.EPSS 1.8%CVE-2021-32992—FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may alEPSS 1.8%CVE-2007-5928HIGHOpenBase 10.0.5 and earlier allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECTEPSS 1.8%CVE-2024-0532HIGHTenda A15 Web-based Management Interface WifiExtraSet set_repeat5 stack-based overflowEPSS 1.8%CVE-2024-11960HIGHD-Link DIR-605L formSetPortTr buffer overflowEPSS 1.8%CVE-2024-11959HIGHD-Link DIR-605L formResetStatistic buffer overflowEPSS 1.8%CVE-2017-6745—A vulnerability in the cache server within Cisco Videoscape Distribution Suite (VDS) for Television 3.2(5)ES1 could allow an unauthenticatedEPSS 1.7%CVE-2018-0103—A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a local attackEPSS 1.7%CVE-2019-1772HIGHCisco Webex Network Recording Player Arbitrary Code Execution VulnerabilityEPSS 1.7%CVE-2019-1773HIGHCisco Webex Network Recording Player Arbitrary Code Execution VulnerabilitiesEPSS 1.7%CVE-2019-3561—Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versionEPSS 1.7%CVE-2020-13496MEDIUMAn exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file EPSS 1.7%CVE-2021-44016—A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (AlEPSS 1.7%CVE-2022-32934HIGHThe issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. A rEPSS 1.7%CVE-2021-32994HIGHSofting OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory BufferEPSS 1.7%CVE-2024-3832HIGHObject corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a craEPSS 1.7%CVE-2017-12359—A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files could allow an attacker tEPSS 1.7%