← Back
CWE-120

4,417 CVEs • Abstraction: Base • Likelihood of Exploit: High

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

JSON object

Loading...

CVEs (4,417)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-46564
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46561
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46560
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46559
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46558
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46557
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46556
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46555
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46554
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46553
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46552
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46551
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-46550
1Draytek
1Vigor3910 Firmware
Jun 17, 2026
Sep 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-44160
1Apple
1Macos
Jun 17, 2026
Sep 17, 2024
N/A· v4
5.5 MEDIUM· v3
N/A· v2
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. Processing a maliciously crafted texture may lead to unexpected app ter...Show more
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. Processing a maliciously crafted texture may lead to unexpected app termination.Show less
CVE-2024-46419
1Totolink
1T8 Firmware
Jun 17, 2026
Sep 16, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWizardCfg function via the ssid5g parameter.
CVE-2024-46451
1Totolink
1T8 Firmware
Jun 17, 2026
Sep 16, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter.
CVE-2024-46424
1Totolink
1T8 Firmware
Jun 17, 2026
Sep 16, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the UploadCustomModule function, which allows attackers to cause a Denial of Service (DoS) via the File parameter.
CVE-2024-46045
1Tenda
1Ch22 Firmware
Jun 17, 2026
Sep 13, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function.
CVE-2024-24972
-
-
Jun 17, 2026
Sep 11, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorised and authenticated operator to reboot the Controller, causing a Denial of Servi...Show more
Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorised and authenticated operator to reboot the Controller, causing a Denial of Service. Gallagher recommend the diagnostic web page is not enabled (default is off) unless advised by Gallagher Technical support. This interface is intended only for diagnostic purposes. This issue affects: Controller 6000 and Controller 7000 9.10 prior to vCR9.10.240816a (distributed in 9.10.1530 (MR2)), 9.00 prior to vCR9.00.240816a (distributed in 9.00.2168 (MR4)), 8.90 prior to vCR8.90.240816a (distributed in 8.90.2155 (MR5)), 8.80 prior to vCR8.80.240816b (distributed in 8.80.1938 (MR6)), all versions of 8.70 and prior.Show less
CVE-2024-40659
1Google
1Android
Jun 17, 2026
Sep 11, 2024
N/A· v4
5.5 MEDIUM· v3
N/A· v2
In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore key generation feature by updating the attestation keys of all installed apps due to improper input...Show more
In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore key generation feature by updating the attestation keys of all installed apps due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Show less