Falhas do tipo CWE-129

287 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo leitura ou escrita fora dos limites da estrutura. Um atacante pode explorar isso para ler dados sensíveis da memória adjacente, sobrescrever dados críticos ou executar código arbitrário.

Exemplo

Um aplicativo web recebe um ID de usuário vindo de um parâmetro GET e o usa diretamente como índice em um array de usuários sem verificar se está dentro do tamanho válido. Um atacante fornece um índice negativo ou muito grande, acessando registros de outros usuários ou corrompendo estruturas internas.

Como mitigar

Sempre validar o índice antes do acesso: verificar se está >= 0 e < tamanho_do_array. Use bibliotecas que oferecem acesso seguro a coleções (como listas tipadas em linguagens modernas) e implemente testes de boundary para casos extremos durante o desenvolvimento.

CVE-2023-40477HIGHRARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 12.3%CVE-2023-0755CRITICAL The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remoteEPSS 11.8%CVE-2023-46724HIGHSQUID-2023:4 Denial of Service in SSL Certificate validationEPSS 4.0%CVE-2005-0369MEDIUMArmagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 earlier allows remote attackers to cause a denial of service (application craEPSS 3.5%CVE-2020-10071CRITICALInsufficient publish message length validation in MQTTEPSS 3.4%CVE-2020-35636CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_pEPSS 3.3%CVE-2022-48503HIGHThe issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS MontereyEPSS 3.2%KEVCVE-2020-28601CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.9%CVE-2020-35628CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.9%CVE-2020-28636CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.9%CVE-2020-25792HIGHAn issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when coEPSS 2.8%CVE-2019-1837MEDIUMCisco Unified Communications Manager Denial of Service VulnerabilityEPSS 2.4%CVE-2020-35634CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.4%CVE-2020-35635CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_pEPSS 2.4%CVE-2020-35633CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.3%CVE-2020-28623CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28617CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28615CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28620CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28616CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%