Falhas do tipo CWE-120

3.163 resultados

Estouro de buffer clássico

A aplicação copia dados em um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente. Isso pode corromper variáveis, desviar o fluxo de execução ou injetar código malicioso que será executado com os mesmos privilégios da aplicação.

Exemplo

Um formulário web aceita um nome de usuário e o copia direto em um array de 32 bytes sem checar comprimento. Um atacante envia 200 bytes; o excesso sobrescreve o endereço de retorno da função, desviando a execução para código dele. Comum em CGI antigos, serviços network e binários C/C++ mal escritos.

Como mitigar

Use funções seguras (strncpy, strlcpy em vez de strcpy; snprintf em vez de sprintf) que respeitam limites. Sempre valide e sanitize entrada externa antes de copiar. Em C moderno, considere AddressSanitizer ou ferramentas estáticas para detectar cópias inseguras em tempo de compilação.

CVE-2026-7248CRITICALD-Link DI-8100 CGI Endpoint tgfile.htm tgfile_htm buffer overflowEPSS 2.2%CVE-2025-4347HIGHD-Link DIR-600L formWlSiteSurvey buffer overflowEPSS 2.2%CVE-2020-8261—A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.EPSS 2.2%CVE-2022-39344CRITICALAzure RTOS USBX vulnerable to buffer overflow EPSS 2.1%CVE-2024-7832HIGHD-Link DNS-1550-04 photocenter_mgr.cgi cgi_get_fullscreen_photos buffer overflowEPSS 2.1%CVE-2023-45614CRITICALThere are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending EPSS 2.1%CVE-2023-22779CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22786CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2022-29189MEDIUMBuffer for inbound DTLS fragments has no limitEPSS 2.1%CVE-2022-24754HIGHBuffer overflow in pjsipEPSS 2.1%CVE-2023-3346CRITICALDenial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC SeriesEPSS 2.1%CVE-2022-31414HIGHD-Link DIR-1960 firmware DIR-1960_A1_1.11 was discovered to contain a buffer overflow via srtcat in prog.cgi. This vulnerability allowed attEPSS 2.1%CVE-2023-22780CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22781CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22784CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22783CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22785CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2023-22782CRITICALUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolEPSS 2.1%CVE-2022-35927HIGHUnverified DIO prefix info lengths in RPL-Classic in Contiki-NGEPSS 2.1%CVE-2025-55847HIGHWavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises becauseEPSS 2.0%