CWE-193 Off-by-one Error
baseA product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (332)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-3156US | high7.8OT critical | KEV | ||
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line arg… | ||||
| CVE-2003-0466US | critical9.8 | Exploit | ||
Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 throug… | ||||
| CVE-2022-3786US | high7.5 | Exploit | ||
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification… | ||||
| CVE-2021-23017US | high7.7 | Exploit | ||
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in… | ||||
| CVE-2001-0609US | critical9.8 | Exploit | ||
Format string vulnerability in Infodrom cfingerd 1.4.3 and earlier allows a remote attacker to gain additional privileges via a malformed ident reply that is passed to the syslog f… | ||||
| CVE-2002-0083US | critical9.8 | Exploit | ||
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges. | ||||
| CVE-2002-1816US | critical9.8 | Exploit | ||
Off-by-one buffer overflow in the sock_gets function in sockhelp.c for ATPhttpd 0.4b and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. | ||||
| CVE-2022-34970US | critical9.8 | Exploit | ||
Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers to remotely execute a… | ||||
| CVE-2018-8828US | critical9.8 | — | ||
A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From ta… | ||||
| CVE-2023-28709US | high7.5 | — | ||
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector set… | ||||
| CVE-2014-5119US | high7.5 | Exploit | ||
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or exec… | ||||
| CVE-2003-0252US | critical9.8 | — | ||
Off-by-one error in the xlog function of mountd in the Linux NFS utils package (nfs-utils) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute ar… | ||||
| CVE-2008-0122US | high10.0 | — | ||
Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to… | ||||
| CVE-2004-0005US | critical9.8 | — | ||
Multiple buffer overflows in Gaim 0.75 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) octal encoding in yahoo_decode that causes a… | ||||
| CVE-2016-10160US | critical9.8 | — | ||
Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory co… | ||||
| CVE-2015-0469US | high10.0 | — | ||
Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related… | ||||
| CVE-2003-0625US | high7.5 | Exploit | ||
Off-by-one error in certain versions of xfstt allows remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake, which leaks t… | ||||
| CVE-2003-0356US | critical9.8 | — | ||
Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP… | ||||
| CVE-2010-3454US | high9.3 | — | ||
Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to cause a denial of serv… | ||||
| CVE-2002-0653US | high7.8 | Exploit | ||
Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute ar… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan