← Back
CWE-119

14,552 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

JSON object

Loading...

CVEs (14,552)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2011-5293
1Threediffy
1Threedify Designer
May 6, 2026
Jan 1, 2015
N/A· v4
N/A· v3
9.3 HIGH· v2
The cmdSave method in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll in ThreeDify Designer 5.0.2 allows remote attackers to write to arbitrary files via a pathname in the argument.
CVE-2011-5288
1Threedify
1Threedify Designer
May 6, 2026
Jan 1, 2015
N/A· v4
N/A· v3
9.3 HIGH· v2
Multiple buffer overflows in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll in ThreeDify Designer 5.0.2 allow remote attackers to execute arbitrary code via a long argument to the (1) cmdExport, (2)...Show more
Multiple buffer overflows in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll in ThreeDify Designer 5.0.2 allow remote attackers to execute arbitrary code via a long argument to the (1) cmdExport, (2) cmdImport, (3) cmdOpen, or (4) cmdSave method.Show less
CVE-2014-8145
3Debian
OracleSound Exchange Project
3Debian Linux
SolarisSound Exchange
May 6, 2026
Dec 31, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or (2) AdpcmReadBlock function.
CVE-2014-9188
1Schneider Electric
1Proclima
May 6, 2026
Dec 27, 2014
N/A· v4
N/A· v3
9.0 HIGH· v2
Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8513 and...Show more
Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8513 and CVE-2014-8514. NOTE: this may be clarified later based on details provided by researchers.Show less
CVE-2014-8514
1Schneider Electric
1Proclima
May 6, 2026
Dec 27, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8513 and...Show more
Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8513 and CVE-2014-9188. NOTE: this may be clarified later based on details provided by researchers.Show less
CVE-2014-8513
1Schneider Electric
1Proclima
May 6, 2026
Dec 27, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8514 and...Show more
Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8514 and CVE-2014-9188. NOTE: this may be clarified later based on details provided by researchers.Show less
CVE-2014-8512
1Schneider Electric
1Proclima
May 6, 2026
Dec 27, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8511. NOT...Show more
Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8511. NOTE: this may be clarified later based on details provided by researchers.Show less
CVE-2014-8511
1Schneider Electric
1Proclima
May 6, 2026
Dec 27, 2014
N/A· v4
N/A· v3
10.0 HIGH· v2
Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8512. NOT...Show more
Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8512. NOTE: this may be clarified later based on details provided by researchers.Show less
CVE-2011-3623
1Videolan
1Vlc Media Player
May 6, 2026
Dec 26, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 allow remote attackers to execute arbitrary code via (1) a crafted ASF file, related to the ASF_ObjectDumpDebug function in modules/demux/as...Show more
Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 allow remote attackers to execute arbitrary code via (1) a crafted ASF file, related to the ASF_ObjectDumpDebug function in modules/demux/asf/libasf.c; (2) a crafted AVI file, related to the AVI_ChunkDumpDebug_level function in modules/demux/avi/libavi.c; or (3) a crafted MP4 file, related to the __MP4_BoxDumpStructure function in modules/demux/mp4/libmp4.c.Show less
CVE-2010-1445
1Videolan
1Vlc Media Player
May 6, 2026
Dec 26, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Heap-based buffer overflow in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream in an RTMP sessio...Show more
Heap-based buffer overflow in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream in an RTMP session.Show less
CVE-2010-1444
1Videolan
1Vlc Media Player
May 6, 2026
Dec 26, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted a...Show more
The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive.Show less
CVE-2010-1442
1Videolan
1Vlc Media Player
May 6, 2026
Dec 26, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) A...Show more
VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) ASF, or (3) Matroska (aka MKV) demuxer.Show less
CVE-2010-1441
1Videolan
1Vlc Media Player
May 6, 2026
Dec 26, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the (...Show more
Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) A/52, (2) DTS, or (3) MPEG Audio decoder.Show less
CVE-2014-9418
1Huawei
1Espace Desktop
May 6, 2026
Dec 24, 2014
N/A· v4
N/A· v3
2.1 LOW· v2
The eSpace Meeting ActiveX control (eSpaceStatusCtrl.dll) in Huawei eSpace Desktop before V200R001C03 allows local users to cause a denial of service (memory overflow) via unspecified vectors.
CVE-2014-9223
1Allegrosoft
1Rompager
May 6, 2026
Dec 24, 2014
N/A· v4
N/A· v3
10.0 HIGH· v2
Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei Home Gateway products and other vendors and products, allow remote attackers to cause a denial of service or possibly execute arbitrary code via unspec...Show more
Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei Home Gateway products and other vendors and products, allow remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors related to authorization.Show less
CVE-2014-8138
2Jasper Project
Redhat
2Enterprise Linux
Jasper
May 6, 2026
Dec 24, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file.
CVE-2014-7286
1Symantec
1Deployment Solution
May 6, 2026
Dec 22, 2014
N/A· v4
N/A· v3
7.2 HIGH· v2
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.
CVE-2014-9295
1Ntp
1Ntp
May 6, 2026
Dec 20, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is...Show more
Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.Show less
CVE-2013-7401
1C Icap Project
1C Icap
May 6, 2026
Dec 19, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS meth...Show more
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.Show less
CVE-2014-9380
1Ettercap Project
1Ettercap
May 6, 2026
Dec 19, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a packet containing only a CVS_LOGIN signature.