Falhas do tipo CWE-119

3.268 resultados

Corrupção de Memória Genérica

É uma categoria abrangente que descreve qualquer acesso indevido à memória — escrever fora dos limites de um buffer, ler dados não inicializados, ou manipular ponteiros inválidos. O risco é grave: permite execução de código arbitrário, travamento da aplicação ou exposição de dados sensíveis.

Exemplo

Um programa em C copia dados do usuário para um array sem validar o tamanho (strcpy em vez de strncpy). Um atacante envia uma string maior que o buffer, sobrescrevendo dados adjacentes ou até o endereço de retorno da função, permitindo injetar código malicioso.

Como mitigar

Use funções seguras (strncpy, snprintf, memmove com limites explícitos), valide e sanitize toda entrada antes de copiar, ative canários de pilha e ASLR no SO, e aplique sanitizadores (ASAN, UBSAN) durante desenvolvimento e testes. Em linguagens seguras (Rust, Python) o problema é praticamente eliminado.

CVE-2019-15247HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15252HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15250HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2026-90793MEDIUMGPAC MP4Box base_scenegraph.c gf_node_get_name use after freeEPSS 0.6%CVE-2019-15243HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2019-15242HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%CVE-2021-1527MEDIUMCisco Webex Player Memory Corruption VulnerabilityEPSS 0.6%CVE-2022-42278HIGHNVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memorEPSS 0.6%CVE-2025-32033HIGHApollo Router Operation Limits Vulnerable to Bypass via Integer OverflowEPSS 0.6%CVE-2025-3203MEDIUMTenda W18E setModules formSetAccountList stack-based overflowEPSS 0.6%CVE-2026-2180HIGHTenda RX3 fast_setting_wifi_set stack-based overflowEPSS 0.6%CVE-2022-41184—Due to lack of proper memory management, when a victim opens a manipulated Windows Cursor File (.cur, ico.x3d) file received from untrusted EPSS 0.6%CVE-2021-4010—A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcScreenSaverSEPSS 0.6%CVE-2021-4009—A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcXFixesCreateEPSS 0.6%CVE-2025-9362MEDIUMLinksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 urlFilterManageRule stack-based overflowEPSS 0.6%CVE-2026-9605MEDIUMGNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflowEPSS 0.6%CVE-2026-86716MEDIUMCesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflowEPSS 0.6%CVE-2023-40052HIGHProgress Application Server (PAS) for OpenEdge Denial of ServiceEPSS 0.6%CVE-2026-74989CRITICALInternally found bugs fixed in Thunderbird 154EPSS 0.6%CVE-2017-12282—A vulnerability in the Access Network Query Protocol (ANQP) ingress frame processing functionality of Cisco Wireless LAN Controllers could aEPSS 0.6%