Falhas do tipo CWE-120

3.164 resultados

Estouro de buffer clássico

A aplicação copia dados em um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente. Isso pode corromper variáveis, desviar o fluxo de execução ou injetar código malicioso que será executado com os mesmos privilégios da aplicação.

Exemplo

Um formulário web aceita um nome de usuário e o copia direto em um array de 32 bytes sem checar comprimento. Um atacante envia 200 bytes; o excesso sobrescreve o endereço de retorno da função, desviando a execução para código dele. Comum em CGI antigos, serviços network e binários C/C++ mal escritos.

Como mitigar

Use funções seguras (strncpy, strlcpy em vez de strcpy; snprintf em vez de sprintf) que respeitam limites. Sempre valide e sanitize entrada externa antes de copiar. Em C moderno, considere AddressSanitizer ou ferramentas estáticas para detectar cópias inseguras em tempo de compilação.

CVE-2025-10120HIGHTenda AC20 GetParentControlInfo strcpy buffer overflowEPSS 0.8%CVE-2025-5629HIGHTenda AC10 HTTP SetPptpServerCfg formSetPPTPServer buffer overflowEPSS 0.8%CVE-2020-9247—There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parametEPSS 0.8%CVE-2025-5408CRITICALWAVLINK WL-WN576K1 HTTP POST Request login.cgi sys_login buffer overflowEPSS 0.8%CVE-2023-33457HIGHIn Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash.EPSS 0.8%CVE-2024-5243HIGHTP-Link Omada ER605 Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-51888HIGHBuffer Overflow vulnerability in the nomath() function in Mathtex v.1.05 and before allows a remote attacker to cause a denial of service viEPSS 0.8%CVE-2023-51886HIGHBuffer Overflow vulnerability in the main() function in Mathtex 1.05 and before allows a remote attacker to cause a denial of service when uEPSS 0.8%CVE-2025-12622HIGHTenda AC10 SysRunCmd formSysRunCmd buffer overflowEPSS 0.8%CVE-2022-45671HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the appData parameter in the formSetAppFilterRule function.EPSS 0.8%CVE-2022-45663HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function.EPSS 0.8%CVE-2022-45660HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedStartTime parameter in the setSchedWifi function.EPSS 0.8%CVE-2022-45647HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeed parameter in the formSetClientState function.EPSS 0.8%CVE-2022-45656HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function.EPSS 0.8%CVE-2022-45646HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeedUp parameter in the formSetClientState function.EPSS 0.8%CVE-2026-9698HIGHDBI versions before 1.648 for Perl saved errors in a limited-sized bufferEPSS 0.8%CVE-2022-45645HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceMac parameter in the addWifiMacFilter function.EPSS 0.8%CVE-2022-45653HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the page parameter in the fromNatStaticSetting function.EPSS 0.8%CVE-2022-45661HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the setSmartPowerManagement function.EPSS 0.8%CVE-2022-45650HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the firewallEn parameter in the formSetFirewallCfg function.EPSS 0.8%