Weaknesses of type CWE-134

170 results

Uso de string de formato controlada externamente

Ocorre quando a aplicação passa uma string vinda de entrada do usuário diretamente como argumento de formato em funções como printf(), sprintf() ou logging. Um atacante pode injetar especificadores de formato (%x, %s, %n) para ler ou escrever dados arbitrários na memória, comprometendo confidencialidade e integridade.

Example

Um programa web recebe um parâmetro 'nome' do usuário e faz `printf(nome)` em vez de `printf("%s", nome)`. Um atacante envia 'nome=%x.%x.%x' e consegue vazar dados da pilha; ou usa '%n' para sobrescrever endereços de memória.

How to mitigate

Nunca passe entrada do usuário diretamente como string de formato. Use sempre um formato fixo: `printf("%s", entrada_usuario)` em C, ou equivalente em outras linguagens. Em logs, sanitize ou use APIs de logging estruturado que não interpretam strings de formato.

CVE-2023-35087CRITICALASUS RT-AX56U V2 & RT-AC86U - Format String - 2EPSS 1.1%CVE-2023-36639HIGHA use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4EPSS 1.1%CVE-2020-1979HIGHPAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalationEPSS 1.0%CVE-2022-35876HIGHFour format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit EPSS 1.0%CVE-2022-35875HIGHFour format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit EPSS 1.0%CVE-2022-35874HIGHFour format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit EPSS 1.0%CVE-2022-35877HIGHFour format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit EPSS 1.0%CVE-2026-69395MEDIUMActive Directory Certificate Services (AD CS) Information Disclosure VulnerabilityEPSS 1.0%CVE-2022-43869MEDIUMIBM Spectrum Scale denial of serviceEPSS 1.0%CVE-2025-40600CRITICALUse of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause EPSS 1.0%CVE-2024-42330CRITICALJS - Internal strings in HTTP headersEPSS 0.9%CVE-2026-33210HIGHRuby JSON has a format string injection vulnerabilityEPSS 0.9%CVE-2023-6764HIGH A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.3EPSS 0.9%CVE-2023-48221HIGHwire-avs remote format string vulnerability EPSS 0.9%CVE-2023-41349HIGHASUS RT-AX88U - externally-controlled format stringEPSS 0.9%CVE-2022-35878HIGHFour format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 0.8%CVE-2022-35881HIGHFour format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 0.8%CVE-2022-35879HIGHFour format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 0.8%CVE-2022-35880HIGHFour format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9EPSS 0.8%CVE-2026-94520MEDIUMMicrosoft SQL Server Denial of Service VulnerabilityEPSS 0.8%