VYPR

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

BaseIncompleteLikelihood: High

Description

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-10 · CAPEC-100 · CAPEC-14 · CAPEC-24 · CAPEC-42 · CAPEC-44 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-67 · CAPEC-8 · CAPEC-9 · CAPEC-92

CVEs mapped to this weakness (4,491)

page 11 of 225
  • CVE-2025-7673CriJul 16, 2025
    risk 0.64cvss 9.8epss 0.01

    A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and potentially execute arbitrary code by sending a…

  • CVE-2023-38036CriJul 12, 2025
    risk 0.64cvss 9.8epss 0.03

    A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could result in service disruption or arbitrary code execution.

  • CVE-2015-0843CriJun 26, 2025
    risk 0.64cvss 9.8epss 0.00

    yubiserver before 0.6 is prone to buffer overflows due to misuse of sprintf.

  • CVE-2025-6098CriJun 16, 2025
    risk 0.64cvss 9.8epss 0.01

    A vulnerability was found in UTT 进取 750W up to 5.0. It has been classified as critical. This affects the function strcpy of the file /goform/setSysAdm of the component API. The manipulation of the argument passwd1 leads to buffer overflow. It is possible to initiate the…

  • CVE-2025-46060CriJun 13, 2025
    risk 0.64cvss 9.8epss 0.01

    Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component

  • CVE-2025-32105CriJun 3, 2025
    risk 0.64cvss 9.8epss 0.01

    A buffer overflow in the the Sangoma IMG2020 HTTP server through 2.3.9.6 allows an unauthenticated user to achieve remote code execution.

  • CVE-2025-5408CriJun 1, 2025
    risk 0.64cvss 9.8epss 0.01

    A vulnerability was found in WAVLINK QUANTUM D2G, QUANTUM D3G, WL-WN530G3A, WL-WN530HG3, WL-WN532A3 and WL-WN576K1 up to V1410_240222 and classified as critical. Affected by this issue is the function sys_login of the file /cgi-bin/login.cgi of the component HTTP POST Request…

  • CVE-2025-45863CriMay 13, 2025
    risk 0.64cvss 9.8epss 0.01

    TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the macstr parameter in the formMapDelDevice interface.

  • CVE-2025-45865CriMay 13, 2025
    risk 0.64cvss 9.8epss 0.01

    TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the dnsaddr parameter in the formDhcpv6s interface.

  • CVE-2025-45861CriMay 13, 2025
    risk 0.64cvss 9.8epss 0.01

    TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the routername parameter in the formDnsv6 interface.

  • CVE-2025-45779CriMay 12, 2025
    risk 0.64cvss 9.8epss 0.07

    Tenda AC10 V1.0re_V15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST parameter.

  • CVE-2025-28024CriApr 22, 2025
    risk 0.64cvss 9.8epss 0.01

    TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the cstecgi.cgi

  • CVE-2025-29047CriApr 17, 2025
    risk 0.64cvss 9.8epss 0.01

    Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the hiddenIndex in the function StorageEditUser

  • CVE-2025-29046CriApr 17, 2025
    risk 0.64cvss 9.8epss 0.01

    Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the GAPSMinute3 key value

  • CVE-2025-29045CriApr 17, 2025
    risk 0.64cvss 9.8epss 0.01

    Buffer Overflow vulnerability in ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the newap_text_0 key value

  • CVE-2025-29044CriApr 17, 2025
    risk 0.64cvss 9.8epss 0.01

    Buffer Overflow vulnerability in Netgear- R61 router V1.0.1.28 allows a remote attacker to execute arbitrary code via the QUERY_STRING key value

  • CVE-2025-25456CriApr 15, 2025
    risk 0.64cvss 9.8epss 0.01

    Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via mac2.

  • CVE-2025-29462CriApr 3, 2025
    risk 0.64cvss 9.8epss 0.01

    A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. The vulnerability occurs when the webCgiGetUploadFile function calls the socketRead function to process HTTP request messages, resulting in the overwriting of a buffer on the stack.

  • CVE-2025-24266CriMar 31, 2025
    risk 0.64cvss 9.8epss 0.01

    A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to cause unexpected system termination.

  • CVE-2025-24237CriMar 31, 2025
    risk 0.64cvss 9.8epss 0.02

    A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, visionOS 2.4, watchOS 11.4. An app may be able to cause unexpected system termination.