Weaknesses of type CWE-193

109 results

Erro de índice por um (off-by-one)

Ocorre quando o código usa um índice incorreto em operações com arrays, buffers ou loops — tipicamente iterando uma posição a mais ou a menos do que deveria. Isso causa acesso a memória inválida, leitura de dados além dos limites da estrutura ou corrupção de dados adjacentes.

Example

Um loop que processa um array de 10 elementos mas itera de 0 a 10 (em vez de 0 a 9) e tenta acessar array[10], lendo ou sobrescrevendo memória fora do escopo da variável. Ou uma validação de tamanho que permite um byte além do buffer esperado.

How to mitigate

Use índices a partir de 0 e compare com tamanho (i < tamanho, nunca <=). Prefira iteradores de linguagens modernas (for-each, ranges) em vez de índices manuais. Aplique testes automáticos com fuzzing e análise estática para detectar essas falhas antes da produção.

CVE-2021-3156HIGHSudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root EPSS 99.3%KEVCVE-2023-44444HIGHGIMP PSP File Parsing Off-By-One Remote Code Execution VulnerabilityEPSS 56.4%CVE-2021-23017—A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cauEPSS 53.5%CVE-2023-28709—Apache Tomcat: Fix for CVE-2023-24998 is incompleteEPSS 49.9%CVE-2002-1816CRITICALOff-by-one buffer overflow in the sock_gets function in sockhelp.c for ATPhttpd 0.4b and earlier allows remote attackers to execute arbitrarEPSS 9.0%CVE-2006-4574HIGHOff-by-one error in the MIME Multipart dissector in Wireshark (formerly Ethereal) 0.10.1 through 0.99.3 allows remote attackers to cause a dEPSS 4.2%CVE-2019-8272—UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attaEPSS 3.9%CVE-2019-8268—UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadStrEPSS 3.9%CVE-2020-10062CRITICALPacket length decoding error in MQTTEPSS 2.9%CVE-2020-14510CRITICALOFF-BY-ONE ERROR CWE-193EPSS 2.5%CVE-1999-1568HIGHOff-by-one error in NcFTPd FTP server before 2.4.1 allows a remote attacker to cause a denial of service (crash) via a long PORT command.EPSS 2.3%CVE-2024-36136HIGHAn off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting EPSS 2.2%CVE-2021-46848CRITICALGNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.EPSS 2.1%CVE-2020-14508HIGHOFF-BY-ONE ERROR CWE-193EPSS 2.0%CVE-2021-21938CRITICALA heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted fEPSS 1.8%CVE-2022-47517HIGHAn issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (EPSS 1.5%CVE-2024-10442CRITICALOff-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 aEPSS 1.3%CVE-2019-10131MEDIUMAn off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.cEPSS 1.3%CVE-2020-27793—An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c. This could allow an attacker to cause a crasEPSS 0.9%CVE-2024-38441CRITICALNetatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in EPSS 0.9%