Falhas do tipo CWE-787

5.133 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2020-17412HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaEPSS 4.2%CVE-2021-21071HIGHAdobe Animate memory corruption vulnerabilityEPSS 4.2%CVE-2019-10961—In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper validation of user supEPSS 4.1%CVE-2022-24091HIGHAdobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 4.1%CVE-2020-10825CRITICALA stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300BEPSS 4.1%CVE-2020-10824CRITICALA stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices beforEPSS 4.1%CVE-2024-20756HIGHAdobe Bridge 2024 Out of Bound Write Remote Code Execution VulnerabilityEPSS 4.1%CVE-2018-20253—In WinRAR versions prior to and including 5.60, There is an out-of-bounds write vulnerability during parsing of a crafted LHA / LZH archive EPSS 4.0%CVE-2021-28622HIGHAdobe Animate BMP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 4.0%CVE-2021-21054HIGHAdobe Illustrator Out-Of-Bounds Write Vulnerability Could Lead To Remote Code Execution VulnerabilityEPSS 4.0%CVE-2024-39423HIGHZDI-CAN-24182: New Vulnerability Report - Adobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 3.9%CVE-2023-48315HIGHAzure RTOS NetX Duo Remote Code Execution VulnerabilityEPSS 3.9%CVE-2022-41674HIGHAn issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80EPSS 3.9%CVE-2020-9907HIGHA memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An apEPSS 3.9%KEVCVE-2021-21094HIGHAdobe Bridge PDF File Parsing Out-Of-Bounds Write vulnerability could lead to arbitrary code executionEPSS 3.9%CVE-2021-21095HIGHAdobe Bridge TTF Font Parsing Out-Of-Bounds Write vulnerability could lead to arbitrary code executionEPSS 3.9%CVE-2020-16918HIGHBase3D Remote Code Execution VulnerabilityEPSS 3.9%CVE-2018-17692—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.2.0.9297. User interaEPSS 3.9%CVE-2019-13323HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interacEPSS 3.9%CVE-2020-9674HIGHAdobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code exeEPSS 3.9%