Fallos del tipo CWE-134

154 resultados

Uso de String de Formato Controlada Externamente

Ocorre quando a aplicação passa uma string fornecida pelo usuário diretamente como primeiro argumento de funções de formatação (como printf, sprintf, syslog em C/C++). Um atacante injeta especificadores de formato (%x, %s, %n) para ler dados sensíveis da memória, causar travamento ou executar código arbitrário.

Ejemplo

Um servidor web recebe um parâmetro de entrada e o passa direto para syslog sem validação: syslog(LOG_INFO, user_input). Se user_input contiver "%x %x %x", a função extrai valores da pilha e expõe dados da memória.

Cómo mitigar

Nunca use entrada de usuário como string de formato. Sempre passe uma string fixa como formato e a entrada do usuário como argumento: printf("%s", user_input). Implemente validação rigorosa de entrada e use análise estática de código para detectar padrões suspeitos.

CVE-2023-22923MEDIUMA format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authentiEPSS 0.8%CVE-2023-48784MEDIUMA use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all veEPSS 0.8%CVE-2023-53966CRITICALSOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer OverflowEPSS 0.7%CVE-2023-29181HIGHA use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 throEPSS 0.7%CVE-2011-10029HIGHSolar FTP Server <= 2.1.1 Malformed USER Denial of ServiceEPSS 0.7%CVE-2015-10088MEDIUMayttm proxy.c http_connect format stringEPSS 0.7%CVE-2024-45324HIGHA use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, veEPSS 0.7%CVE-2024-12805HIGHA post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads tEPSS 0.7%CVE-2023-2186HIGHOn Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message iEPSS 0.7%CVE-2023-45583MEDIUMA use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions,EPSS 0.7%CVE-2022-24051HIGHMariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate priviEPSS 0.7%CVE-2022-26393MEDIUMFormat String vulnerabilityEPSS 0.7%CVE-2023-6399MEDIUMA format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4EPSS 0.6%CVE-2024-50397HIGHQTS, QuTS heroEPSS 0.6%CVE-2022-26392LOWFormat String vulnerabilityEPSS 0.6%CVE-2024-50396HIGHQTS, QuTS heroEPSS 0.6%CVE-2024-45330MEDIUMA use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to EPSS 0.6%CVE-2022-3023MEDIUMUse of Externally-Controlled Format String in pingcap/tidbEPSS 0.6%CVE-2023-24590HIGH A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instaEPSS 0.6%CVE-2026-17136CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.6%