Falhas do tipo CWE-787

5.145 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2023-33638HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.EPSS 0.9%CVE-2023-33637HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm.EPSS 0.9%CVE-2023-33631HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DelSTList interface at /goform/aspForm.EPSS 0.9%CVE-2023-33641HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm.EPSS 0.9%CVE-2023-33636HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspFoEPSS 0.9%CVE-2023-33642HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.EPSS 0.9%CVE-2023-33634HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm.EPSS 0.9%CVE-2023-33627HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.EPSS 0.9%CVE-2023-33640HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspEPSS 0.9%CVE-2023-33635HIGHH3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.EPSS 0.9%CVE-2026-21413CRITICALA heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. AEPSS 0.9%CVE-2022-23566HIGHOut of bounds write in TensorflowEPSS 0.9%CVE-2024-38439CRITICALNetatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginEPSS 0.9%CVE-2025-62164HIGHVLLM deserialization vulnerability leading to DoS and potential RCEEPSS 0.9%CVE-2023-5168CRITICALA compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potenEPSS 0.9%CVE-2022-48078CRITICALpycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode.EPSS 0.9%CVE-2023-2072HIGHRockwell Automation PowerMonitor 1000 Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2021-28816HIGHStack Buffer Overflow Vulnerabilities in QTS, QuTS hero, and QuTScloudEPSS 0.9%CVE-2022-48130CRITICALTenda W20E v15.11.0.6 was discovered to contain multiple stack overflows in the function formSetStaticRoute via the parameters staticRouteNeEPSS 0.9%CVE-2023-26805CRITICALTenda W20E v15.11.0.6 (US_W20EV4.0br_v15.11.0.6(1068_1546_841)_CN_TDC) is vulnerable to Buffer Overflow via function formIPMacBindModify.EPSS 0.9%