Weaknesses of type CWE-134

154 results

Uso de string de formato controlada externamente

Ocorre quando a aplicação passa uma string vinda de entrada do usuário diretamente como argumento de formato em funções como printf(), sprintf() ou logging. Um atacante pode injetar especificadores de formato (%x, %s, %n) para ler ou escrever dados arbitrários na memória, comprometendo confidencialidade e integridade.

Example

Um programa web recebe um parâmetro 'nome' do usuário e faz `printf(nome)` em vez de `printf("%s", nome)`. Um atacante envia 'nome=%x.%x.%x' e consegue vazar dados da pilha; ou usa '%n' para sobrescrever endereços de memória.

How to mitigate

Nunca passe entrada do usuário diretamente como string de formato. Use sempre um formato fixo: `printf("%s", entrada_usuario)` em C, ou equivalente em outras linguagens. Em logs, sanitize ou use APIs de logging estruturado que não interpretam strings de formato.

CVE-2024-50401LOWQTS, QuTS heroEPSS 0.6%CVE-2024-50398LOWQTS, QuTS heroEPSS 0.6%CVE-2024-50400LOWQTS, QuTS heroEPSS 0.6%CVE-2024-50399LOWQTS, QuTS heroEPSS 0.6%CVE-2026-12174HIGHD-Link DCS-935L HTTP rhea snprintf format stringEPSS 0.6%CVE-2025-68648MEDIUMA use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7,EPSS 0.6%CVE-2024-50402LOWQTS, QuTS heroEPSS 0.5%CVE-2017-7519LOWIn Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service usinEPSS 0.5%CVE-2023-25492MEDIUMA valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a fEPSS 0.5%CVE-2024-50403LOWQTS, QuTS heroEPSS 0.5%CVE-2024-39529HIGHJunos OS: SRX Series: If DNS traceoptions are configured in a DGA or tunnel detection scenario specific DNS traffic leads to a PFE crashEPSS 0.5%CVE-2026-6250HIGHAuthenticated Format String Injection on TP-Link Tapo C110EPSS 0.5%CVE-2025-48730MEDIUMQTS, QuTS heroEPSS 0.4%CVE-2026-57877HIGHGV-LPC2011/LPC2211 - unauthorized format string vulnerability (vlsvr)EPSS 0.4%CVE-2024-9129CRITICALFormat String Injection in Zend ServerEPSS 0.4%CVE-2026-0400MEDIUMA post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.EPSS 0.4%CVE-2025-52666LOWImproper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administratorEPSS 0.4%CVE-2026-15680HIGHLorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-46465MEDIUMDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.4%CVE-2026-81574HIGHFormat String Vulnerability in LoggerEPSS 0.4%