Falhas do tipo CWE-120

3.163 resultados

Estouro de buffer clássico

A aplicação copia dados em um buffer sem validar o tamanho, permitindo que um atacante sobrescreva memória adjacente. Isso pode corromper variáveis, desviar o fluxo de execução ou injetar código malicioso que será executado com os mesmos privilégios da aplicação.

Exemplo

Um formulário web aceita um nome de usuário e o copia direto em um array de 32 bytes sem checar comprimento. Um atacante envia 200 bytes; o excesso sobrescreve o endereço de retorno da função, desviando a execução para código dele. Comum em CGI antigos, serviços network e binários C/C++ mal escritos.

Como mitigar

Use funções seguras (strncpy, strlcpy em vez de strcpy; snprintf em vez de sprintf) que respeitam limites. Sempre valide e sanitize entrada externa antes de copiar. Em C moderno, considere AddressSanitizer ou ferramentas estáticas para detectar cópias inseguras em tempo de compilação.

CVE-2018-14879HIGHThe command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().EPSS 4.7%CVE-2021-40709HIGHAdobe Photoshop Buffer Overflow leads to Arbitrary Code ExecutionEPSS 4.6%CVE-2026-7856HIGHD-Link DI-8100 Web Management url_member.asp buffer overflowEPSS 4.6%CVE-2018-1054—An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4EPSS 4.6%CVE-2025-12232HIGHTenda CH22 SafeClientFilter fromSafeClientFilter buffer overflowEPSS 4.5%CVE-2019-5143HIGHAn exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A firmware version 1.13EPSS 4.5%CVE-2022-23188HIGHAdobe Illustrator Buffer Overflow could lead to Arbitrary code executionEPSS 4.4%CVE-2025-12233HIGHTenda CH22 SafeUrlFilter fromSafeUrlFilter buffer overflowEPSS 4.3%CVE-2022-23187HIGHAdobe Illustrator 2022 Buffer Overflow could lead to Arbitrary code executionEPSS 4.3%CVE-2015-0973HIGHBuffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent atEPSS 4.3%CVE-2020-6087HIGHAn exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENTEPSS 4.3%CVE-2020-6084HIGHAn exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AEPSS 4.3%CVE-2020-6086HIGHAn exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENTEPSS 4.3%CVE-2020-6085HIGHAn exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AEPSS 4.3%CVE-2025-29032MEDIUMTenda AC9 v15.03.05.19(6318) was discovered to contain a buffer overflow via the formWifiWpsOOB function.EPSS 4.2%CVE-2021-45039CRITICALMultiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) EPSS 4.2%CVE-2022-23219CRITICALThe deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argEPSS 4.2%CVE-2020-6083HIGHAn exploitable denial of service vulnerability exists in the ENIP Request Path Port Segment functionality of Allen-Bradley Flex IO 1794-AENTEPSS 4.2%CVE-2019-3705HIGHBuffer Overflow VulnerabilityEPSS 4.2%CVE-2026-7857HIGHD-Link DI-8100 CGI user_group.asp sprintf buffer overflowEPSS 4.2%