Falhas do tipo CWE-787

5.843 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2021-30498—A flaw was found in libcaca. A heap buffer overflow in export.c in function export_tga might lead to memory corruption and other potential cEPSS 1.3%CVE-2022-28665MEDIUMA memory corruption vulnerability exists in the httpd unescape functionality of FreshTomato 2022.1. A specially-crafted HTTP request can leaEPSS 1.3%CVE-2024-47541MEDIUMGHSL-2024-228: GStreamer has an out-of-bounds write in SSA subtitle parserEPSS 1.3%CVE-2021-27399—A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MEPSS 1.3%CVE-2021-25665—A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2021.2.1). The starview+.exe application lacks proper valEPSS 1.3%CVE-2021-27387—A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MEPSS 1.3%CVE-2026-70058HIGHWindows DHCP Server Remote Code Execution VulnerabilityEPSS 1.3%CVE-2022-31901MEDIUMBuffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two craftEPSS 1.3%CVE-2021-27634HIGHSAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.EPSS 1.3%CVE-2024-47539HIGHGHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1aEPSS 1.3%CVE-2022-47388HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47382HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47384HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47380HIGHCODESYS: Multiple products prone to out-of-bounds writeEPSS 1.3%CVE-2022-47387HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47381HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47383HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2021-38684HIGHBuffer Overflow Vulnerability in Multimedia ConsoleEPSS 1.3%CVE-2022-47389HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%CVE-2022-47390HIGHCODESYS: Multiple products prone to stack based out-of-bounds writeEPSS 1.3%