Falhas do tipo CWE-119

3.239 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2017-6739HIGHA vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to rEPSS 10.9%KEVCVE-2025-7088HIGHBelkin F9K1122 webs formPPPoESetup stack-based overflowEPSS 10.9%CVE-2017-1000253HIGHLinux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86EPSS 10.7%KEVCVE-2025-7087HIGHBelkin F9K1122 webs formL2TPSetup stack-based overflowEPSS 10.5%CVE-2025-6543CRITICALMemory overflow vulnerability leading to unintended control flow and Denial of ServiceEPSS 10.1%KEVCVE-2015-2546HIGHThe kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows SeEPSS 10.1%KEVCVE-2025-8184HIGHD-Link DIR-513 HTTP POST Request formSetWanL2TPtriggers formSetWanL2TPcallback stack-based overflowEPSS 9.9%CVE-1999-1588CRITICALBuffer overflow in nlps_server in Sun Solaris x86 2.4, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code as root via a long sEPSS 9.9%CVE-2025-8017HIGHTenda AC7 httpd setMacFilterCfg formSetMacFilterCfg stack-based overflowEPSS 9.1%CVE-2021-34859HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. User interaction is EPSS 8.9%CVE-2017-3853—A vulnerability in the Data-in-Motion (DMo) process installed with the Cisco IOx application environment could allow an unauthenticated, remEPSS 8.7%CVE-2025-2620CRITICALD-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflowEPSS 8.7%CVE-2025-0566HIGHTenda AC15 SetDevNetName formSetDevNetName stack-based overflowEPSS 8.7%CVE-2025-9482HIGHLinksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 portRangeForwardAdd stack-based overflowEPSS 8.5%CVE-2025-11549HIGHTenda W12 HTTP Request modules wifiMacFilterSet stack-based overflowEPSS 8.5%CVE-2025-8180HIGHTenda CH22 deleteUserName formdeleteUserName buffer overflowEPSS 8.5%CVE-2025-4883HIGHD-Link DI-8100 Connection Limit Page ctxz.asp ctxz_asp stack-based overflowEPSS 8.2%CVE-2012-2034HIGHAdobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 EPSS 7.8%KEVCVE-2025-8140HIGHTOTOLINK A702R HTTP POST Request formWlanMultipleAP buffer overflowEPSS 7.8%CVE-2025-8138HIGHTOTOLINK A702R HTTP POST Request formOneKeyAccessButton buffer overflowEPSS 7.8%