Fallos del tipo CWE-134

154 resultados

Uso de String de Formato Controlada Externamente

Ocorre quando a aplicação passa uma string fornecida pelo usuário diretamente como primeiro argumento de funções de formatação (como printf, sprintf, syslog em C/C++). Um atacante injeta especificadores de formato (%x, %s, %n) para ler dados sensíveis da memória, causar travamento ou executar código arbitrário.

Ejemplo

Um servidor web recebe um parâmetro de entrada e o passa direto para syslog sem validação: syslog(LOG_INFO, user_input). Se user_input contiver "%x %x %x", a função extrai valores da pilha e expõe dados da memória.

Cómo mitigar

Nunca use entrada de usuário como string de formato. Sempre passe uma string fixa como formato e a entrada do usuário como argumento: printf("%s", user_input). Implemente validação rigorosa de entrada e use análise estática de código para detectar padrões suspeitos.

CVE-2012-10055CRITICALComSndFTP v1.3.7 Beta USER Format String RCEEPSS 1.6%CVE-2021-33535HIGHWEIDMUELLER: WLAN devices affected by exploitable format string vulnerabilityEPSS 1.6%CVE-2025-64157MEDIUMA use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2EPSS 1.4%CVE-2020-15634MEDIUMThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmwEPSS 1.4%CVE-2023-39238HIGHASUS RT-AX55、RT-AX56U_V2 - Format String - 1EPSS 1.4%CVE-2022-35244CRITICALA format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X aEPSS 1.3%CVE-2022-35884HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2022-35885HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2022-35887HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2022-35886HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2025-46121CRITICALAn issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addSEPSS 1.3%CVE-2023-39240HIGHASUS RT-AX55、RT-AX56U_V2 - Format String - 3EPSS 1.3%CVE-2023-39239HIGHASUS RT-AX55、RT-AX56U_V2、RT-AC86U - Format String - 2EPSS 1.3%CVE-2024-6145HIGHActiontec WCB6200Q Cookie Format String Remote Code Execution VulnerabilityEPSS 1.2%CVE-2024-35845CRITICALwifi: iwlwifi: dbg-tlv: ensure NUL terminationEPSS 1.2%CVE-2019-6840—A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server PluEPSS 1.1%CVE-2025-46123HIGHAn issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.EPSS 1.1%CVE-2023-35087CRITICALASUS RT-AX56U V2 & RT-AC86U - Format String - 2EPSS 1.1%CVE-2023-36639HIGHA use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4EPSS 1.1%CVE-2020-1979HIGHPAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalationEPSS 1.0%