cve.bz

CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow), page 56

Filter

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

What the weakness is: CWE-120 at MITRE

Ask an AI about CWE-120

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-120: Buffer Copy without Checking Size of Input and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/120.html and https://cve.bz/cve/cwe/120?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2023-22779EPSS 2.1%

    There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP por…

  2. 7.8CVE-2023-30257EPSS 0.4%

    A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root.

  3. 5.5CVE-2023-29932EPSS 0.2%

    llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpOperand.

  4. 9.8CVE-2023-21504EPSS 0.6%

    Potential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.

  5. 9.8CVE-2023-21503EPSS 0.6%

    Potential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.

  6. 9.8CVE-2023-21494EPSS 0.7%

    Potential buffer overflow vulnerability in auth api in mm_Authentication.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access.

  7. 5.7CVE-2023-27892EPSS 0.5%

    Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontro…

  8. 9.8CVE-2023-29856EPSS 0.9%

    D-Link DIR-868L Hardware version A1, firmware version 1.12 is vulnerable to Buffer Overflow. The vulnerability is in scandir.sgi binary.

  9. 4.9CVE-2023-22924EPSS 0.8%

    A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker with administrator privileges to cause denial-of-service (DoS) conditions by executing crafted…

  10. 7.5CVE-2023-22922EPSS 0.9%

    A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote unauthenticated attacker to cause DoS conditions by sending crafted packets if Telnet is enabled on a vulnerable devi…

  11. 9.8CVE-2023-27972EPSS 1.5%

    Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Remote Code Execution.

  12. 9.8CVE-2023-27971EPSS 0.9%

    Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Elevation of Privilege.

  13. 9.8CVE-2023-28769ExploitEPSS 5.4%

    The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to execute some OS commands or to cause …

  14. 9.8CVE-2023-30280EPSS 1.2%

    Buffer Overflow vulnerability found in Netgear R6900 v.1.0.2.26, R6700v3 v.1.0.4.128, R6700 v.1.0.0.26 allows a remote attacker to execute arbitrary code and cause a denial ofservice via the getInputData parameter of the fwSchedule.cgi pag…

  15. 7.8CVE-2023-29596EPSS 0.3%

    Buffer Overflow vulnerability found in ByronKnoll Cmix v.19 allows an attacker to execute arbitrary code and cause a denial of service via the paq8 function.

  16. 5.5CVE-2023-26930EPSS 0.3%

    Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Vendor states “it's an expected abort on out-of-memory error.”

  17. 7.5CVE-2022-44232EPSS 0.7%

    libming 0.4.8 0.4.8 is vulnerable to Buffer Overflow. In getInt() in decompile.c unknown type may lead to denial of service. This is a different vulnerability than CVE-2018-9132 and CVE-2018-20427.

  18. 7.5CVE-2023-22917EPSS 0.9%

    A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firmware versions 5.00 through 5.32, USG FLEX 50(W) firmware versions 5.10 through 5.32, USG20(W)-VPN …

  19. 7.5CVE-2023-22915EPSS 1.1%

    A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.30 through 5.35, USG20(W)-VPN firmware versions 4.30 through 5.35, and…

  20. 5.3CVE-2023-2241EPSS 0.4%

    A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack has to b…

  21. 7.8CVE-2023-25505EPSS 0.2%

    NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler of the AMI MegaRAC BMC , where an attacker with the appropriate level of authorization can cause a buffer overflow, which may lead to denial of service, information disclosure, …

  22. 7.8CVE-2021-33971EPSS 0.4%

    Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Total Security (http://www.360totalsecurity.com/) is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: This is…

  23. 10.0CVE-2021-33975EPSS 1.4%

    Buffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows attacker to escalate privileges.

  24. 8.8CVE-2021-33974EPSS 1.0%

    Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Chrome (https://browser.360.cn/ee/) is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: This is a set of vul…

  25. 7.8CVE-2021-33973EPSS 0.4%

    Buffer Overflow vulnerability in Qihoo 360 Safe guard v12.1.0.1004, v12.1.0.1005, v13.1.0.1001 allows attacker to escalate priveleges.

  26. 10.0CVE-2021-33972EPSS 1.3%

    Buffer Overflow vulnerability in Qihoo 360 Safe Browser v13.0.2170.0 allows attacker to escalate priveleges.

  27. 7.5CVE-2023-27705EPSS 0.8%

    APNG_Optimizer v1.4 was discovered to contain a buffer overflow via the component /apngopt/ubuntu.png.

  28. 8.8CVE-2022-33288EPSS 0.1%

    Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information.

  29. 9.8CVE-2022-33259EPSS 0.4%

    Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.

  30. 9.8CVE-2022-25740EPSS 0.4%

    Memory corruption in modem due to buffer overwrite while building an IPv6 multicast address based on the MAC address of the iface

  31. 9.8CVE-2022-25678EPSS 0.4%

    Memory correction in modem due to buffer overwrite during coap connection

  32. 5.5CVE-2022-24350EPSS 0.2%

    An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI function 0x17 verifies that the output buffer lies within the command buffer but does not verify that output data does not go beyond the end of the …

  33. 5.5CVE-2020-24736EPSS 0.3%

    Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script.

  34. 5.5CVE-2022-47464EPSS 0.08%

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  35. 5.5CVE-2022-47463EPSS 0.08%

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  36. 5.5CVE-2022-47362EPSS 0.08%

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  37. 5.5CVE-2022-47336EPSS 0.08%

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  38. 5.5CVE-2022-47335EPSS 0.08%

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  39. 7.8CVE-2023-26733EPSS 0.4%

    Buffer Overflow vulnerability found in tinyTIFF v.3.0 allows a local attacker to cause a denial of service via the TinyTiffReader_readNextFrame function in tinytiffreader.c file.

  40. 7.5CVE-2020-23257EPSS 0.9%

    Buffer Overflow vulnerability found in Espruino 2v05.41 allows an attacker to cause a denial of service via the function jsvGarbageCollectMarkUsed in file src/jsvar.c.

  41. 9.8CVE-2020-19695EPSS 1.3%

    Buffer Overflow found in Nginx NJS allows a remote attacker to execute arbitrary code via the njs_object_property parameter of the njs/njs_vm.c function.

  42. 9.8CVE-2020-19692EPSS 1.3%

    Buffer Overflow vulnerabilty found in Nginx NJS v.0feca92 allows a remote attacker to execute arbitrary code via the njs_module_read in the njs_module.c file.

  43. 6.5CVE-2023-0977EPSS 0.6%

    A heap-based overflow vulnerability in Trellix Agent (Windows and Linux) version 5.7.8 and earlier, allows a remote user to alter the page heap in the macmnsvc process memory block resulting in the service becoming unavailable.

  44. 9.8CVE-2023-25076EPSS 66%

    A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba). A specially crafted HTTP or TLS packet can lead to arbitrary cod…

  45. 8.8CVE-2023-28508EPSS 0.9%

    Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a heap-based overflow vulnerability, where certain input can corrupt the heap and crash the forked…

  46. 8.8CVE-2023-28506EPSS 0.9%

    Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow, where a string is copied into a buffer using a memcpy-like function…

  47. 8.8CVE-2023-28505EPSS 0.8%

    Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a buffer overflow in an API function, where a string is copied into a caller-provided buffer witho…

  48. 9.8CVE-2023-28504EPSS 1.4%

    Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow that can lead to remote code execution as the root user.

  49. 9.8CVE-2023-28502ExploitEPSS 61%

    Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the "udadmin" service that can lead to remote code execution as t…

  50. 7.8CVE-2022-42431EPSS 0.3%

    This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to execute privileged code on the target system in order to exploit this vulnerability. The specific fla…