Falhas do tipo CWE-120

3.164 resultados

Estouro de buffer clássico

A aplicação copia dados em um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente. Isso pode corromper variáveis, desviar o fluxo de execução ou injetar código malicioso que será executado com os mesmos privilégios da aplicação.

Exemplo

Um formulário web aceita um nome de usuário e o copia direto em um array de 32 bytes sem checar comprimento. Um atacante envia 200 bytes; o excesso sobrescreve o endereço de retorno da função, desviando a execução para código dele. Comum em CGI antigos, serviços network e binários C/C++ mal escritos.

Como mitigar

Use funções seguras (strncpy, strlcpy em vez de strcpy; snprintf em vez de sprintf) que respeitam limites. Sempre valide e sanitize entrada externa antes de copiar. Em C moderno, considere AddressSanitizer ou ferramentas estáticas para detectar cópias inseguras em tempo de compilação.

CVE-2022-44178CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow. via function formWifiWpsOOB.EPSS 0.7%CVE-2022-44180CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter.EPSS 0.7%CVE-2022-44172CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function R7WebsSecurityHandler.EPSS 0.7%CVE-2022-44177CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart.EPSS 0.7%CVE-2022-44171CRITICALTenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form_fast_setting_wifi_set.EPSS 0.7%CVE-2022-44174CRITICALTenda AC18 V15.03.05.05 is vulnerable to Buffer Overflow via function formSetDeviceName.EPSS 0.7%CVE-2023-47995MEDIUMMemory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers toEPSS 0.7%CVE-2024-46419CRITICALTOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWizardCfg function via the ssid5g parameter.EPSS 0.7%CVE-2022-43391MEDIUMA buffer overflow vulnerability in the parameter of the CGI program in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an EPSS 0.7%CVE-2025-1899HIGHTenda TX3 setPptpUserList buffer overflowEPSS 0.7%CVE-2026-28959HIGHA buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5EPSS 0.7%CVE-2024-47248MEDIUMApache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stackEPSS 0.7%CVE-2026-20664MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visioEPSS 0.7%CVE-2024-57538MEDIUMLinksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (anonymous_protect_status) is copieEPSS 0.7%CVE-2026-1158HIGHTotolink LR350 POST Request cstecgi.cgi setWizardCfg buffer overflowEPSS 0.7%CVE-2026-1156HIGHTotolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflowEPSS 0.7%CVE-2024-57540MEDIUMLinksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (action) is copied to the stack witEPSS 0.7%CVE-2024-27572HIGHLBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the updateCurAPlist function. This vulneraEPSS 0.7%CVE-2024-29507MEDIUMArtifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.EPSS 0.7%CVE-2020-8252—The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which EPSS 0.7%