Falhas do tipo CWE-787

5.846 resultados

Escrita fora dos limites de memória

Ocorre quando um programa escreve dados em um endereço de memória fora da área alocada para um buffer ou variável. O código não valida o tamanho ou índice antes de gravar, permitindo sobrescrita de dados adjacentes, corrupção de estruturas críticas ou execução de código arbitrário.

Exemplo

Um formulário web que copia dados do usuário para um buffer de 256 bytes sem validar o tamanho da entrada. Se o atacante envia 500 bytes, a escrita transborda e sobrescreve a pilha, podendo hijackear o endereço de retorno da função.

Como mitigar

Use funções seguras de cópia (strncpy, strlcpy ao invés de strcpy; memcpy com tamanho máximo explícito) e sempre valide comprimento e índices antes de escrever. Em linguagens modernas, prefira estruturas com bounds-checking automático (arrays em Java, Rust, etc).

CVE-2022-36086HIGHlinked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`EPSS 0.9%CVE-2021-36493HIGHBuffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.EPSS 0.9%CVE-2022-44167HIGHTenda AC15 V15.03.05.18 is avulnerable to Buffer Overflow via function formSetPPTPServer.EPSS 0.9%CVE-2024-24186CRITICALJsish v3.5.0 (commit 42c694c) was discovered to contain a stack-overflow via the component IterGetKeysCallback at /jsish/src/jsiValue.c.EPSS 0.9%CVE-2022-40104HIGHTenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDget function. This vulnerability allows attackers to EPSS 0.9%CVE-2022-44163HIGHTenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.EPSS 0.9%CVE-2022-44169HIGHTenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer.EPSS 0.9%CVE-2022-44156HIGHTenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind.EPSS 0.9%CVE-2022-44158HIGHTenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.EPSS 0.9%CVE-2022-44168HIGHTenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function fromSetRouteStatic..EPSS 0.9%CVE-2020-36773CRITICALArtifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a singleEPSS 0.9%CVE-2022-40102HIGHTenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDset function. This vulnerability allows attackers to EPSS 0.9%CVE-2024-20039HIGHIn modem protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no aEPSS 0.9%CVE-2022-40648HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.9%CVE-2026-56211HIGHLibaom: libaom: remote code execution via svc layer context handling with attacker-controlled framesEPSS 0.9%CVE-2023-2854MEDIUMBLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileEPSS 0.9%CVE-2023-2857MEDIUMBLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture fileEPSS 0.9%CVE-2021-43814HIGHHeap-based OOB write when parsing dwarf DIE info in RizinEPSS 0.9%CVE-2022-23478CRITICALOut of Bound Write in xrdpEPSS 0.9%CVE-2022-45337HIGHTenda TX9 Pro v22.03.02.10 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind.EPSS 0.9%