CWE-787
Out-of-bounds Write
Description
The product writes data past the end, or before the beginning, of the intended buffer.
Hierarchy (View 1000)
CVEs mapped to this weakness (14,880)
page 735 of 744| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-25022 | Cri | 0.00 | 9.8 | 0.03 | Sep 4, 2020 | An issue was discovered in Noise-Java through 2020-08-27. AESGCMFallbackCipherState.encryptWithAd() allows out-of-bounds access. | ||
| CVE-2020-25021 | Cri | 0.00 | 9.8 | 0.03 | Sep 4, 2020 | An issue was discovered in Noise-Java through 2020-08-27. ChaChaPolyCipherState.encryptWithAd() allows out-of-bounds access. | ||
| CVE-2020-15900 | Cri | 0.00 | 9.8 | 0.05 | Jul 28, 2020 | A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max… | ||
| CVE-2020-15888 | Hig | 0.00 | 8.8 | 0.02 | Jul 21, 2020 | Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free. | ||
| CVE-2020-9395 | Hig | 0.00 | 8.0 | 0.01 | Jul 6, 2020 | An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer. | ||
| CVE-2020-15474 | Cri | 0.00 | 9.8 | 0.01 | Jul 1, 2020 | In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c. | ||
| CVE-2017-18922 | Cri | 0.00 | 9.8 | 0.02 | Jun 30, 2020 | It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow. | ||
| CVE-2020-15306 | Med | 0.00 | 5.5 | 0.00 | Jun 26, 2020 | An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp. | ||
| CVE-2020-14404 | Med | 0.00 | 5.4 | 0.02 | Jun 17, 2020 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings. | ||
| CVE-2020-14403 | Med | 0.00 | 5.4 | 0.02 | Jun 17, 2020 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings. | ||
| CVE-2020-14402 | Med | 0.00 | 5.4 | 0.02 | Jun 17, 2020 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings. | ||
| CVE-2019-20840 | Hig | 0.00 | 7.5 | 0.03 | Jun 17, 2020 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode. | ||
| CVE-2020-14147 | Hig | 0.00 | 7.7 | 0.03 | Jun 15, 2020 | An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox… | ||
| CVE-2020-13901 | Cri | 0.00 | 9.8 | 0.03 | Jun 10, 2020 | An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_merge in sdp.c has a stack-based buffer overflow. | ||
| CVE-2020-10061 | Hig | 0.00 | 8.1 | 0.01 | Jun 5, 2020 | Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions. | ||
| CVE-2020-13765 | Med | 0.00 | 5.6 | 0.02 | Jun 4, 2020 | rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation. | ||
| CVE-2020-13398 | Hig | 0.00 | 8.3 | 0.02 | May 22, 2020 | An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. | ||
| CVE-2020-10021 | Hig | 0.00 | 8.1 | 0.00 | May 11, 2020 | Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions. | ||
| CVE-2020-12762 | Hig | 0.00 | 7.8 | 0.02 | May 9, 2020 | json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. | ||
| CVE-2020-12659 | Med | 0.00 | 6.7 | 0.01 | May 5, 2020 | An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) because of a lack of headroom validation. |
- risk 0.00cvss 9.8epss 0.03
An issue was discovered in Noise-Java through 2020-08-27. AESGCMFallbackCipherState.encryptWithAd() allows out-of-bounds access.
- risk 0.00cvss 9.8epss 0.03
An issue was discovered in Noise-Java through 2020-08-27. ChaChaPolyCipherState.encryptWithAd() allows out-of-bounds access.
- risk 0.00cvss 9.8epss 0.05
A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max…
- risk 0.00cvss 8.8epss 0.02
Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.
- risk 0.00cvss 8.0epss 0.01
An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.
- risk 0.00cvss 9.8epss 0.01
In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c.
- risk 0.00cvss 9.8epss 0.02
It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.
- risk 0.00cvss 5.5epss 0.00
An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp.
- risk 0.00cvss 5.4epss 0.02
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.
- risk 0.00cvss 5.4epss 0.02
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.
- risk 0.00cvss 5.4epss 0.02
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.
- risk 0.00cvss 7.5epss 0.03
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.
- risk 0.00cvss 7.7epss 0.03
An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox…
- risk 0.00cvss 9.8epss 0.03
An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_merge in sdp.c has a stack-based buffer overflow.
- risk 0.00cvss 8.1epss 0.01
Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions.
- risk 0.00cvss 5.6epss 0.02
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
- risk 0.00cvss 8.3epss 0.02
An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.
- risk 0.00cvss 8.1epss 0.00
Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.
- risk 0.00cvss 7.8epss 0.02
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.
- risk 0.00cvss 6.7epss 0.01
An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write (by a user with the CAP_NET_ADMIN capability) because of a lack of headroom validation.