Falhas do tipo CWE-119

3.506 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2025-6115HIGHD-Link DIR-619L form_macfilter stack-based overflowEPSS 1.6%CVE-2025-6114HIGHD-Link DIR-619L form_portforwarding stack-based overflowEPSS 1.6%CVE-2024-23614CRITICALSymantec Messaging Gateway Buffer OverflowEPSS 1.6%CVE-2017-12278—A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Wireless LAN Controllers could allow an authenticated, rEPSS 1.6%CVE-2019-6571—A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS EPSS 1.6%CVE-2025-1539HIGHD-Link DAP-1320 storagein.pd-XXXXXX replace_special_char stack-based overflowEPSS 1.6%CVE-2017-6669—Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files. An attEPSS 1.6%CVE-2021-20325—Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securitEPSS 1.6%CVE-2025-4356HIGHTenda DAP-1520 Authentication storage mod_graph_auth_uri_handler stack-based overflowEPSS 1.6%CVE-2024-1112HIGHBuffer Overflow Vulnerability in Resource HackerEPSS 1.6%CVE-2025-4346HIGHD-Link DIR-600L formSetWAN_Wizard534 buffer overflowEPSS 1.6%CVE-2025-4344HIGHD-Link DIR-600L formLogin buffer overflowEPSS 1.6%CVE-2025-4345HIGHD-Link DIR-600L formSetLog buffer overflowEPSS 1.6%CVE-2019-6541—A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow arbitrary code executioEPSS 1.6%CVE-2021-4157—An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replEPSS 1.6%CVE-2018-0209—A vulnerability in the Simple Network Management Protocol (SNMP) subsystem communication channel through the Cisco 550X Series Stackable ManEPSS 1.6%CVE-2025-10432CRITICALTenda AC1206 HTTP Request AdvSetMacMtuWa check_param_changed stack-based overflowEPSS 1.6%CVE-2020-35522—In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial oEPSS 1.6%CVE-2017-12267—A vulnerability in the Independent Computing Architecture (ICA) accelerator feature for the Cisco Wide Area Application Services (WAAS) coulEPSS 1.6%CVE-2021-46153—A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application EPSS 1.6%