Falhas do tipo CWE-119

3.263 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2023-31247CRITICALA memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specialEPSS 1.7%CVE-2023-28379CRITICALA memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially craEPSS 1.7%CVE-2025-7544HIGHTenda AC1206 setMacFilterCfg formSetMacFilterCfg stack-based overflowEPSS 1.7%CVE-2024-23617CRITICALSymantec Data Loss Prevention Buffer OverflowEPSS 1.7%CVE-2023-3138—A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values EPSS 1.7%CVE-2021-1278HIGHCisco SD-WAN Denial of Service VulnerabilitiesEPSS 1.7%CVE-2019-12807—Alzip 10.83 and earlier version contains a stack-based buffer overflow vulnerability, caused by improper bounds checking during the parsing EPSS 1.6%CVE-2020-3500MEDIUMCisco StarOS IPv6 Denial of Service VulnerabilityEPSS 1.6%CVE-2025-4871MEDIUMPCMan FTP Server REST Command buffer overflowEPSS 1.6%CVE-2020-11058LOWImproper Restriction of Operations within the Bounds of a Memory Buffer in FreeRDPEPSS 1.6%CVE-2024-23614CRITICALSymantec Messaging Gateway Buffer OverflowEPSS 1.6%CVE-2017-12278—A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Wireless LAN Controllers could allow an authenticated, rEPSS 1.6%CVE-2026-8452HIGHMemory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of ServiceEPSS 1.6%KEVCVE-2021-34783HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Software-Based SSL/TLS Denial of Service VulnerabilityEPSS 1.6%CVE-2019-6571—A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS EPSS 1.6%CVE-2025-8169HIGHD-Link DIR-513 HTTP POST Request formSetWanPPTPpath formSetWanPPTPcallback buffer overflowEPSS 1.6%CVE-2025-1539HIGHD-Link DAP-1320 storagein.pd-XXXXXX replace_special_char stack-based overflowEPSS 1.6%CVE-2017-6669—Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files. An attEPSS 1.6%CVE-2025-4148HIGHNetgear EX6200 sub_503FC buffer overflowEPSS 1.6%CVE-2025-4149HIGHNetgear EX6200 sub_54014 buffer overflowEPSS 1.6%