Fallos del tipo CWE-134

144 resultados

Uso de String de Formato Controlada Externamente

Ocorre quando a aplicação passa uma string fornecida pelo usuário diretamente como primeiro argumento de funções de formatação (como printf, sprintf, syslog em C/C++). Um atacante injeta especificadores de formato (%x, %s, %n) para ler dados sensíveis da memória, causar travamento ou executar código arbitrário.

Ejemplo

Um servidor web recebe um parâmetro de entrada e o passa direto para syslog sem validação: syslog(LOG_INFO, user_input). Se user_input contiver "%x %x %x", a função extrai valores da pilha e expõe dados da memória.

Cómo mitigar

Nunca use entrada de usuário como string de formato. Sempre passe uma string fixa como formato e a entrada do usuário como argumento: printf("%s", user_input). Implemente validação rigorosa de entrada e use análise estática de código para detectar padrões suspeitos.

CVE-2023-22374HIGHiControl SOAP vulnerabilityEPSS 72.6%CVE-2024-23113CRITICALA use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FoEPSS 61.7%KEVCVE-2019-1579HIGHRemote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or EPSS 46.0%KEVCVE-2023-35086HIGHASUS RT-AX56U V2 & RT-AC86U - Format String -1EPSS 38.5%CVE-2020-3118HIGHCisco IOS XR Software Cisco Discovery Protocol Format String VulnerabilityEPSS 11.7%KEVCVE-2017-0898—Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus valEPSS 9.7%CVE-2019-13318MEDIUMThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.5.0.20723. User intEPSS 5.8%CVE-2025-48826HIGHA format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP rEPSS 4.4%CVE-2025-55298HIGHImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code executionEPSS 4.4%CVE-2020-1992HIGHPAN-OS on PA-7000 Series: Varrcvr daemon network-based denial of service or privilege escalationEPSS 3.4%CVE-2023-4746HIGHTOTOLINK N200RE V5 Validity_check format stringEPSS 3.2%CVE-2021-32785MEDIUMFormat string bug in the Redis cache implementationEPSS 2.7%CVE-2022-26674CRITICALASUS RT-AX88U - Format StringEPSS 2.6%CVE-2017-3859—A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow anEPSS 2.5%CVE-2021-41193CRITICALUse of Externally-Controlled Format String in wire-avsEPSS 2.5%CVE-2022-3724MEDIUMCrash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file onEPSS 2.3%CVE-2017-12702—An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiersEPSS 2.3%CVE-2021-20307—Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary mEPSS 1.9%CVE-2012-10055CRITICALComSndFTP v1.3.7 Beta USER Format String RCEEPSS 1.6%CVE-2022-40604HIGHFormat String VulnerabilityEPSS 1.6%