Falhas do tipo CWE-125

5.076 resultados

Leitura fora dos limites de memória

Ocorre quando o código tenta ler dados de uma posição de memória fora do intervalo alocado para um buffer ou array. O programa não valida o índice ou tamanho antes de acessar, causando leitura de dados inválidos, corrupção de informações ou revelação de dados sensíveis da memória adjacente.

Exemplo

Um processador de imagem PNG lê 4 bytes de um buffer de 2 bytes para validar uma assinatura, ou uma função copia uma string sem verificar se o índice fornecido pelo usuário extrapola o tamanho real do array. Em ambos os casos, dados fora do escopo pretendido são lidos.

Como mitigar

Sempre validar índices e comprimentos contra os limites reais do buffer antes de qualquer leitura. Usar funções seguras (ex: `strncpy` em vez de `strcpy`, bounds-checking em loops) e implementar testes com entradas extremas (size zero, índices negativos, valores muito grandes).

CVE-2020-12018—Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorizeEPSS 1.5%CVE-2021-34881LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.5%CVE-2021-36001LOWAdobe Character Animator PNG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.5%CVE-2023-35296MEDIUMMicrosoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityEPSS 1.5%CVE-2021-44183LOWAdobe Dimension TIF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.5%CVE-2021-31881HIGHA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.5%CVE-2024-28515CRITICALBuffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of csEPSS 1.5%CVE-2022-2183HIGHOut-of-bounds Read in vim/vimEPSS 1.5%CVE-2020-11049MEDIUMOut-of-bounds Read in FreeRDPrdp_read_share_control_headerEPSS 1.5%CVE-2022-0368MEDIUMOut-of-bounds Read in vim/vimEPSS 1.5%CVE-2021-34916LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.5%CVE-2021-46608LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16EPSS 1.5%CVE-2021-34882LOWThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User inteEPSS 1.5%CVE-2023-32044HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 1.5%CVE-2023-32045HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 1.5%CVE-2022-1069HIGHSofting Secure Integration Server Out-of-bounds ReadEPSS 1.5%CVE-2020-6104MEDIUMAn exploitable information disclosure vulnerability exists in the get_dnode_of_data functionality of F2fs-Tools F2fs.Fsck 1.13. A specially EPSS 1.5%CVE-2024-41833MEDIUMZDI-CAN-24310: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.5%CVE-2021-27606HIGHSAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC -EPSS 1.5%CVE-2021-27629HIGHSAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC -EPSS 1.5%