Falhas do tipo CWE-120

3.164 resultados

Estouro de buffer clássico

A aplicação copia dados em um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente. Isso pode corromper variáveis, desviar o fluxo de execução ou injetar código malicioso que será executado com os mesmos privilégios da aplicação.

Exemplo

Um formulário web aceita um nome de usuário e o copia direto em um array de 32 bytes sem checar comprimento. Um atacante envia 200 bytes; o excesso sobrescreve o endereço de retorno da função, desviando a execução para código dele. Comum em CGI antigos, serviços network e binários C/C++ mal escritos.

Como mitigar

Use funções seguras (strncpy, strlcpy em vez de strcpy; snprintf em vez de sprintf) que respeitam limites. Sempre valide e sanitize entrada externa antes de copiar. Em C moderno, considere AddressSanitizer ou ferramentas estáticas para detectar cópias inseguras em tempo de compilação.

CVE-2022-40994HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2022-40999HIGHSeveral stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210EPSS 1.4%CVE-2025-5909HIGHTOTOLINK EX1200T HTTP POST Request formReflashClientTbl buffer overflowEPSS 1.4%CVE-2024-7582HIGHTenda i22 apPortalAccessCodeAuth formApPortalAccessCodeAuth buffer overflowEPSS 1.4%CVE-2024-7583HIGHTenda i22 apPortalOneKeyAuth formApPortalOneKeyAuth buffer overflowEPSS 1.4%CVE-2022-34823CRITICALBuffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SiEPSS 1.4%CVE-2023-26768HIGHBuffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the compileTranslationTabEPSS 1.4%CVE-2024-8579HIGHTOTOLINK AC1200 T8 cstecgi.cgi setWiFiRepeaterCfg buffer overflowEPSS 1.3%CVE-2024-7462HIGHTOTOLINK N350RT cstecgi.cgi setWizardCfg buffer overflowEPSS 1.3%CVE-2024-7465HIGHTOTOLINK CP450 cstecgi.cgi loginauth buffer overflowEPSS 1.3%CVE-2019-1010218—Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact isEPSS 1.3%CVE-2019-0160HIGHBuffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of EPSS 1.3%CVE-2024-39801CRITICALMultiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A speciallyEPSS 1.3%CVE-2022-28722CRITICALCertain HP Print Products are potentially vulnerable to Buffer Overflow.EPSS 1.3%CVE-2020-19695CRITICALBuffer Overflow found in Nginx NJS allows a remote attacker to execute arbitrary code via the njs_object_property parameter of the njs/njs_vEPSS 1.3%CVE-2021-38111HIGHThe DEF CON 27 badge allows remote attackers to exploit a buffer overflow by sending an oversized packet via the NFMI (Near Field Magnetic IEPSS 1.3%CVE-2024-7585HIGHTenda i22 apPortalAuth formApPortalWebAuth buffer overflowEPSS 1.3%CVE-2021-45345HIGHBuffer Overflow vulnerability found in En3rgy WebcamServer v.0.5.2 allows a remote attacker to cause a denial of service via the WebcamServeEPSS 1.3%CVE-2022-26649CRITICALA vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE EPSS 1.3%CVE-2026-2005HIGHPostgreSQL pgcrypto heap buffer overflow executes arbitrary codeEPSS 1.3%