Falhas do tipo CWE-120

3.164 resultados

Estouro de buffer clássico

A aplicação copia dados em um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente. Isso pode corromper variáveis, desviar o fluxo de execução ou injetar código malicioso que será executado com os mesmos privilégios da aplicação.

Exemplo

Um formulário web aceita um nome de usuário e o copia direto em um array de 32 bytes sem checar comprimento. Um atacante envia 200 bytes; o excesso sobrescreve o endereço de retorno da função, desviando a execução para código dele. Comum em CGI antigos, serviços network e binários C/C++ mal escritos.

Como mitigar

Use funções seguras (strncpy, strlcpy em vez de strcpy; snprintf em vez de sprintf) que respeitam limites. Sempre valide e sanitize entrada externa antes de copiar. Em C moderno, considere AddressSanitizer ou ferramentas estáticas para detectar cópias inseguras em tempo de compilação.

CVE-2022-45644HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the formSetClientState function.EPSS 0.8%CVE-2022-45655HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the timeZone parameter in the form_fast_setting_wifi_set functionEPSS 0.8%CVE-2022-45657HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.EPSS 0.8%CVE-2022-45656HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function.EPSS 0.8%CVE-2022-45664HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDget function.EPSS 0.8%CVE-2022-45658HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedEndTime parameter in the setSchedWifi function.EPSS 0.8%CVE-2022-45649HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the endIp parameter in the formSetPPTPServer function.EPSS 0.8%CVE-2022-45670HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function.EPSS 0.8%CVE-2022-45648HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the devName parameter in the formSetDeviceName function.EPSS 0.8%CVE-2022-45653HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the page parameter in the fromNatStaticSetting function.EPSS 0.8%CVE-2025-27832CRITICALAn issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpEPSS 0.8%CVE-2022-45643HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the addWifiMacFilter function.EPSS 0.8%CVE-2022-45671HIGHTenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the appData parameter in the formSetAppFilterRule function.EPSS 0.8%CVE-2022-45645HIGHTenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceMac parameter in the addWifiMacFilter function.EPSS 0.8%CVE-2023-4265MEDIUMBuffer overflow in Zephyr USBEPSS 0.8%CVE-2025-31701HIGHA vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted maliEPSS 0.8%CVE-2023-45797CRITICALDreamSecurity MagicLine Buffer Overflow VulnerabilityEPSS 0.8%CVE-2025-9023HIGHTenda AC7/AC18 SetLEDCfg formSetSchedLed buffer overflowEPSS 0.8%CVE-2026-67869HIGHBuffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates inputEPSS 0.8%CVE-2026-67859HIGHBuffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling.EPSS 0.8%