Falhas do tipo CWE-787

5.145 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2023-24820HIGHRIOT-OS vulnerable to Integer Underflow during IPHC receiveEPSS 0.9%CVE-2023-24821HIGHRIOT-OS vulnerable to Integer Underflow during defragmentationEPSS 0.9%CVE-2022-40102HIGHTenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDset function. This vulnerability allows attackers to EPSS 0.9%CVE-2026-33816CRITICALCVE-2026-33816 in github.com/jackc/pgxEPSS 0.9%CVE-2026-33815CRITICALCVE-2026-33815 in github.com/jackc/pgxEPSS 0.9%CVE-2022-40104HIGHTenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDget function. This vulnerability allows attackers to EPSS 0.9%CVE-2023-33671CRITICALTenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function.EPSS 0.9%CVE-2022-3446HIGHHeap buffer overflow in WebSQL in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption viaEPSS 0.9%CVE-2021-34569CRITICALWAGO I/O-Check Service prone to Out-of-bounds WriteEPSS 0.9%CVE-2021-22751—A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of iEPSS 0.9%CVE-2022-44156HIGHTenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind.EPSS 0.9%CVE-2026-61674CRITICALFluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handlerEPSS 0.9%CVE-2022-3725MEDIUMCrash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture fileEPSS 0.9%CVE-2022-44169HIGHTenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer.EPSS 0.9%CVE-2022-44167HIGHTenda AC15 V15.03.05.18 is avulnerable to Buffer Overflow via function formSetPPTPServer.EPSS 0.9%CVE-2022-44163HIGHTenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.EPSS 0.9%CVE-2022-44168HIGHTenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function fromSetRouteStatic..EPSS 0.9%CVE-2022-44158HIGHTenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.EPSS 0.9%CVE-2026-7829HIGHUltraVNC repeater authenticated out-of-bounds write in rule parser via oversized tokenEPSS 0.9%CVE-2022-1041HIGHOut-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioningEPSS 0.9%