Falhas do tipo CWE-120

3.018 resultados

Estouro de buffer clássico

A aplicação copia dados em um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente. Isso pode corromper variáveis, desviar o fluxo de execução ou injetar código malicioso que será executado com os mesmos privilégios da aplicação.

Exemplo

Um formulário web aceita um nome de usuário e o copia direto em um array de 32 bytes sem checar comprimento. Um atacante envia 200 bytes; o excesso sobrescreve o endereço de retorno da função, desviando a execução para código dele. Comum em CGI antigos, serviços network e binários C/C++ mal escritos.

Como mitigar

Use funções seguras (strncpy, strlcpy em vez de strcpy; snprintf em vez de sprintf) que respeitam limites. Sempre valide e sanitize entrada externa antes de copiar. Em C moderno, considere AddressSanitizer ou ferramentas estáticas para detectar cópias inseguras em tempo de compilação.

CVE-2017-7269CRITICALBuffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows SEPSS 99.8%KEVCVE-2019-11043HIGHUnderflow in PHP-FPM can lead to RCEEPSS 99.4%KEVCVE-2007-5659HIGHMultiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file withEPSS 94.2%KEVCVE-2022-3786HIGHX.509 Email Address Variable Length Buffer OverflowEPSS 92.5%CVE-2023-46847HIGHSquid: denial of service in http digest authenticationEPSS 88.4%CVE-2016-6366HIGHBuffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V,EPSS 87.6%KEVCVE-2016-10174CRITICALThe NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. EPSS 83.5%KEVCVE-2013-1331HIGHBuffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data EPSS 81.9%KEVCVE-2018-6789CRITICALAn issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overfEPSS 81.7%KEVCVE-2021-22908—A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browseEPSS 69.4%CVE-2023-25076CRITICALA buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80dEPSS 65.8%CVE-2010-2572HIGHBuffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 EPSS 62.6%KEVCVE-2023-28502CRITICALStack buffer overflow in UniRPC's udadmin_server serviceEPSS 61.1%CVE-2022-31626HIGHmysqlnd/pdo password buffer overflowEPSS 58.4%CVE-2022-37055CRITICALD-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,EPSS 57.0%KEVCVE-2020-15999CRITICALHeap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viEPSS 50.6%KEVCVE-2021-33035—Buffer overflow from a crafted DBF fileEPSS 50.6%CVE-2006-2492HIGHBuffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allowEPSS 48.4%KEVCVE-2025-15467HIGHStack buffer overflow in CMS (Auth)EnvelopedData parsingEPSS 47.6%CVE-2022-24313—A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leadinEPSS 44.6%