Falhas do tipo CWE-119

3.262 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2025-7206CRITICALD-Link DIR-825 httpd switch_language.cgi sub_410DDC stack-based overflowEPSS 18.4%CVE-2017-0022MEDIUMMicrosoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 EPSS 18.1%KEVCVE-2025-1340HIGHTOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflowEPSS 16.7%CVE-2025-8159HIGHD-Link DIR-513 HTTP POST Request formLanguageChange stack-based overflowEPSS 15.6%CVE-2014-3478MEDIUMBuffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.EPSS 15.2%CVE-2025-5548MEDIUMFreeFloat FTP Server NOOP Command buffer overflowEPSS 15.0%CVE-2018-0151CRITICALA vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, reEPSS 14.2%KEVCVE-2025-3538HIGHD-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflowEPSS 13.2%CVE-2017-3807—A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases 9.0-EPSS 12.8%CVE-2025-5527HIGHTenda RX3 SetStaticRouteCfg save_staticroute_data stack-based overflowEPSS 11.9%CVE-2025-3820HIGHTenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflowEPSS 11.8%CVE-2025-3785HIGHD-Link DWR-M961 Authorization Interface formStaticDHCP stack-based overflowEPSS 11.4%CVE-2025-5905HIGHTOTOLINK T10 POST Request cstecgi.cgi setWiFiRepeaterCfg buffer overflowEPSS 11.3%CVE-2017-16368HIGHAn issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.3035EPSS 11.3%CVE-2017-6740HIGHThe Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow EPSS 11.1%KEVCVE-2025-5903HIGHTOTOLINK T10 POST Request cstecgi.cgi setWiFiAclRules buffer overflowEPSS 11.0%CVE-2025-5904HIGHTOTOLINK T10 POST Request cstecgi.cgi setWiFiMeshName buffer overflowEPSS 11.0%CVE-2025-4544HIGHD-Link DI-8100 jhttpd ddos.asp stack-based overflowEPSS 10.9%CVE-2017-6739HIGHA vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to rEPSS 10.9%KEVCVE-2017-6743HIGHThe Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow EPSS 10.9%KEV