Fallos del tipo CWE-134

170 resultados

Uso de String de Formato Controlada Externamente

Ocorre quando a aplicação passa uma string fornecida pelo usuário diretamente como primeiro argumento de funções de formatação (como printf, sprintf, syslog em C/C++). Um atacante injeta especificadores de formato (%x, %s, %n) para ler dados sensíveis da memória, causar travamento ou executar código arbitrário.

Ejemplo

Um servidor web recebe um parâmetro de entrada e o passa direto para syslog sem validação: syslog(LOG_INFO, user_input). Se user_input contiver "%x %x %x", a função extrai valores da pilha e expõe dados da memória.

Cómo mitigar

Nunca use entrada de usuário como string de formato. Sempre passe uma string fixa como formato e a entrada do usuário como argumento: printf("%s", user_input). Implemente validação rigorosa de entrada e use análise estática de código para detectar padrões suspeitos.

CVE-2024-50397HIGHQTS, QuTS heroEPSS 0.6%CVE-2024-45330MEDIUMA use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to EPSS 0.6%CVE-2023-24590HIGH A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instaEPSS 0.6%CVE-2026-101965HIGHJunos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabledEPSS 0.6%CVE-2024-50398LOWQTS, QuTS heroEPSS 0.6%CVE-2024-50399LOWQTS, QuTS heroEPSS 0.6%CVE-2024-50400LOWQTS, QuTS heroEPSS 0.6%CVE-2024-50401LOWQTS, QuTS heroEPSS 0.6%CVE-2026-12174HIGHD-Link DCS-935L HTTP rhea snprintf format stringEPSS 0.6%CVE-2024-58366CRITICALSurrealDB before 1.1.1 Format String via Scripting FunctionsEPSS 0.6%CVE-2026-76722CRITICALUncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APsEPSS 0.5%CVE-2024-50402LOWQTS, QuTS heroEPSS 0.5%CVE-2026-76753CRITICALUnauthenticated Format String Vulnerability in HPE Networking ClearPass Policy ManagerEPSS 0.5%CVE-2017-7519LOWIn Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service usinEPSS 0.5%CVE-2023-25492MEDIUMA valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a fEPSS 0.5%CVE-2026-67244HIGHA format string vulnerability was found in the Notification OAuth settings of ADMEPSS 0.5%CVE-2026-12004HIGHSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.5%CVE-2026-0400MEDIUMA post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.EPSS 0.5%CVE-2026-68553HIGHCoturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis CommandEPSS 0.5%CVE-2024-50403LOWQTS, QuTS heroEPSS 0.5%