Falhas do tipo CWE-120

3.246 resultados

Estouro de buffer clássico

A aplicação copia dados em um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente. Isso pode corromper variáveis, desviar o fluxo de execução ou injetar código malicioso que será executado com os mesmos privilégios da aplicação.

Exemplo

Um formulário web aceita um nome de usuário e o copia direto em um array de 32 bytes sem checar comprimento. Um atacante envia 200 bytes; o excesso sobrescreve o endereço de retorno da função, desviando a execução para código dele. Comum em CGI antigos, serviços network e binários C/C++ mal escritos.

Como mitigar

Use funções seguras (strncpy, strlcpy em vez de strcpy; snprintf em vez de sprintf) que respeitam limites. Sempre valide e sanitize entrada externa antes de copiar. Em C moderno, considere AddressSanitizer ou ferramentas estáticas para detectar cópias inseguras em tempo de compilação.

CVE-2023-20157HIGHCisco Small Business Series Switches Buffer Overflow VulnerabilitiesEPSS 1.5%CVE-2024-9549HIGHD-Link DIR-605L formEasySetupWizard formEasySetupWizard2 buffer overflowEPSS 1.5%CVE-2024-9534HIGHD-Link DIR-605L formEasySetPassword buffer overflowEPSS 1.5%CVE-2024-9550HIGHD-Link DIR-605L formLogDnsquery buffer overflowEPSS 1.5%CVE-2024-9785HIGHD-Link DIR-619L B1 formSetDDNS buffer overflowEPSS 1.5%CVE-2022-39244HIGHBuffer overflow in pjlib scanner and pjmediaEPSS 1.5%CVE-2022-40986HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.5%CVE-2022-40990HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.5%CVE-2023-27972CRITICALCertain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Remote Code Execution.EPSS 1.5%CVE-2022-40998HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.5%CVE-2024-9532HIGHD-Link DIR-605L formAdvanceSetup buffer overflowEPSS 1.5%CVE-2025-34128HIGHX360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()EPSS 1.5%CVE-2024-24450MEDIUMStack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 alloEPSS 1.5%CVE-2024-7613HIGHTenda FH1206 GstDhcpSetSer fromGstDhcpSetSer buffer overflowEPSS 1.5%CVE-2023-1329—A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Buffer OvEPSS 1.5%CVE-2025-6098CRITICALUTT 进取 750W API setSysAdm strcpy buffer overflowEPSS 1.5%CVE-2025-3988HIGHTOTOLINK N150RT formPortFw buffer overflowEPSS 1.5%CVE-2022-40989HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.5%CVE-2022-40993HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.5%CVE-2022-40999HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.5%