Falhas do tipo CWE-120

3.163 resultados

Estouro de buffer clássico

A aplicação copia dados em um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente. Isso pode corromper variáveis, desviar o fluxo de execução ou injetar código malicioso que será executado com os mesmos privilégios da aplicação.

Exemplo

Um formulário web aceita um nome de usuário e o copia direto em um array de 32 bytes sem checar comprimento. Um atacante envia 200 bytes; o excesso sobrescreve o endereço de retorno da função, desviando a execução para código dele. Comum em CGI antigos, serviços network e binários C/C++ mal escritos.

Como mitigar

Use funções seguras (strncpy, strlcpy em vez de strcpy; snprintf em vez de sprintf) que respeitam limites. Sempre valide e sanitize entrada externa antes de copiar. Em C moderno, considere AddressSanitizer ou ferramentas estáticas para detectar cópias inseguras em tempo de compilação.

CVE-2022-40985HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.6%CVE-2021-33226CRITICALBuffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/moEPSS 1.6%CVE-2022-31019HIGHDoS Vulnerability in URLEncodedFormDecoder in VaporEPSS 1.6%CVE-2023-46012CRITICALBuffer Overflow vulnerability LINKSYS EA7500 3.0.1.207964 allows a remote attacker to execute arbitrary code via an HTTP request to the IGD EPSS 1.6%CVE-2025-4871MEDIUMPCMan FTP Server REST Command buffer overflowEPSS 1.6%CVE-2019-11851CRITICALThe ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows rEPSS 1.6%CVE-2021-33537HIGHWEIDMUELLER: WLAN devices affected by Remote Code Execution (RCE) vulnerabilityEPSS 1.6%CVE-2022-32504CRITICALAn issue was discovered on certain Nuki Home Solutions devices. The code used to parse the JSON objects received from the WebSocket service EPSS 1.6%CVE-2021-20236—A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the EPSS 1.6%CVE-2025-69259HIGHA message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service EPSS 1.6%CVE-2025-69260HIGHA message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service conditionEPSS 1.6%CVE-2022-22683CRITICALBuffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-EPSS 1.6%CVE-2023-21517HIGHHeap out-of-bound write vulnerability in Exynos baseband prior to SMR Jun-2023 Release 1 allows remote attacker to execute arbitrary code.EPSS 1.6%CVE-2025-8169HIGHD-Link DIR-513 HTTP POST Request formSetWanPPTPpath formSetWanPPTPcallback buffer overflowEPSS 1.6%CVE-2021-21939CRITICALA heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can EPSS 1.6%CVE-2025-4149HIGHNetgear EX6200 sub_54014 buffer overflowEPSS 1.6%CVE-2025-4148HIGHNetgear EX6200 sub_503FC buffer overflowEPSS 1.6%CVE-2024-9535HIGHD-Link DIR-605L formEasySetupWWConfig buffer overflowEPSS 1.6%CVE-2024-9786HIGHD-Link DIR-619L B1 formSetLog buffer overflowEPSS 1.6%CVE-2022-39274HIGHBuffer Overflow in `ProcessRadioRxDone` in LoRaMac-nodeEPSS 1.6%