CWE-120— Buffer Copy without Checking Size (Classic Buffer Overflow)

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.— MITRE CWE catalog

4,710 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-120page 13 of 95

CVE-2022-40990CRITICALCVSS 9.8EG 9.8
2023-01-26
Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker…
CVE-2022-40989CRITICALCVSS 9.8EG 9.8
2023-01-26
Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker…
CVE-2022-40988CRITICALCVSS 9.8EG 9.8
2023-01-26
Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker…
CVE-2022-40987CRITICALCVSS 9.8EG 9.8
2023-01-26
Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker…
CVE-2022-40986CRITICALCVSS 9.8EG 9.8
2023-01-26
Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker…
CVE-2022-40985CRITICALCVSS 9.8EG 9.8
2023-01-26
Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker…
CVE-2023-24169CRITICALCVSS 9.8EG 9.8
2023-01-26
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_0007343c.
CVE-2023-22741CRITICALCVSS 9.8EG 9.8
2023-01-19
Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks both message length and attributes length checks** when it handles STUN packets, leading to controlla…
CVE-2022-4498CRITICALCVSS 9.8EG 9.8
2023-01-11
In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP Basic Authentication the httpd service can be sent a crafted packet that causes a heap overflow. This can result in either a DoS (by crashi…
CVE-2022-45995CRITICALCVSS 9.8EG 9.8
2023-01-05
There is an unauthorized buffer overflow vulnerability in Tenda AX12 v22.03.01.21 _ cn. This vulnerability can cause the web service not to restart or even execute arbitrary code. It is a different vulnerability from CVE-2022-2414.
CVE-2019-11851CRITICALCVSS 9.8EG 9.8
2022-12-26
The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to execute arbitrary code via a buffer overflow.
CVE-2022-47949CRITICALCVSS 9.8EG 9.8
2022-12-24
The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn. The victi…
CVE-2022-45721CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the picName parameter in the formDelWewifiPic function.
CVE-2022-45720CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the ip, mac, and remark parameters in the formIPMacBindModify function.
CVE-2022-45719CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the gotoUrl parameter in the formPortalAuth function.
CVE-2022-45718CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formIPMacBindAdd function.
CVE-2022-45716CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the indexSet parameter in the formIPMacBindDel function.
CVE-2022-45715CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pLanPortRange and pWanPortRange parameters in the formSetPortMapping function.
CVE-2022-45714CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the indexSet parameter in the formQOSRuleDel function.
CVE-2022-45712CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formAddDnsForward function.
CVE-2022-45710CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pEnable, pLevel, and pModule parameters in the formSetDebugCfg function.
CVE-2022-45708CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the sPortMapIndex parameter in the formDelPortMapping function.
CVE-2022-45707CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formAddDnsHijack function.
CVE-2022-45706CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the hostname parameter in the formSetNetCheckTools function.
CVE-2022-44283CRITICALCVSS 9.8EG 9.8
2022-11-28
AVS Audio Converter 10.3 is vulnerable to Buffer Overflow.
CVE-2022-44183CRITICALCVSS 9.8EG 9.8
2022-11-21
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetWifiGuestBasic.
CVE-2022-44180CRITICALCVSS 9.8EG 9.8
2022-11-21
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter.
CVE-2022-44178CRITICALCVSS 9.8EG 9.8
2022-11-21
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow. via function formWifiWpsOOB.
CVE-2022-44177CRITICALCVSS 9.8EG 9.8
2022-11-21
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart.
CVE-2022-44176CRITICALCVSS 9.8EG 9.8
2022-11-21
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function fromSetRouteStatic.
CVE-2022-44175CRITICALCVSS 9.8EG 9.8
2022-11-21
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.
CVE-2022-44174CRITICALCVSS 9.8EG 9.8
2022-11-21
Tenda AC18 V15.03.05.05 is vulnerable to Buffer Overflow via function formSetDeviceName.
CVE-2022-44172CRITICALCVSS 9.8EG 9.8
2022-11-21
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function R7WebsSecurityHandler.
CVE-2022-44171CRITICALCVSS 9.8EG 9.8
2022-11-21
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form_fast_setting_wifi_set.
CVE-2022-44204CRITICALCVSS 9.8EG 9.8
2022-11-18
D-Link DIR3060 DIR3060A1_FW111B04.bin is vulnerable to Buffer Overflow.
CVE-2022-34823CRITICALCVSS 9.8EG 9.8
2022-11-08
Buffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earli…
CVE-2022-39344CRITICALCVSS 9.8EG 9.8
2022-11-04
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Prior to version 6.1.12, the USB DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting…
CVE-2022-32941CRITICALCVSS 9.8EG 9.8
2022-11-01
The issue was addressed with improved bounds checks. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. A buffer overflow may result in arbitrary code…
CVE-2021-40241CRITICALCVSS 9.8EG 9.8
2022-10-31
xfig 3.2.7 is vulnerable to Buffer Overflow.
CVE-2021-42553CRITICALCVSS 9.8EG 9.8
2022-10-21
A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typica…
CVE-2022-36361CRITICALCVSS 9.8EG 9.8
2022-10-11
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versi…
CVE-2022-37891CRITICALCVSS 9.8EG 9.8
2022-10-07
Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba In…
CVE-2022-37890CRITICALCVSS 9.8EG 9.8
2022-10-07
Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba In…
CVE-2022-37889CRITICALCVSS 9.8EG 9.8
2022-10-07
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (…
CVE-2022-37887CRITICALCVSS 9.8EG 9.8
2022-10-07
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (…
CVE-2022-37886CRITICALCVSS 9.8EG 9.8
2022-10-07
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (…
CVE-2022-37885CRITICALCVSS 9.8EG 9.8
2022-10-07
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (…
CVE-2022-37888CRITICALCVSS 9.8EG 9.8
2022-10-06
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (…
CVE-2022-28722CRITICALCVSS 9.8EG 9.8
2022-09-26
Certain HP Print Products are potentially vulnerable to Buffer Overflow.
CVE-2022-38573CRITICALCVSS 9.8EG 9.8
2022-09-23
10-Strike Network Inventory Explorer v9.3 was discovered to contain a buffer overflow via the Add Computers function.

Map vulnerabilities like CWE-120 to your infrastructure

EchelonGraph correlates every CVE — across CWE-120 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →