Fallos del tipo CWE-134

154 resultados

Uso de String de Formato Controlada Externamente

Ocorre quando a aplicação passa uma string fornecida pelo usuário diretamente como primeiro argumento de funções de formatação (como printf, sprintf, syslog em C/C++). Um atacante injeta especificadores de formato (%x, %s, %n) para ler dados sensíveis da memória, causar travamento ou executar código arbitrário.

Ejemplo

Um servidor web recebe um parâmetro de entrada e o passa direto para syslog sem validação: syslog(LOG_INFO, user_input). Se user_input contiver "%x %x %x", a função extrai valores da pilha e expõe dados da memória.

Cómo mitigar

Nunca use entrada de usuário como string de formato. Sempre passe uma string fixa como formato e a entrada do usuário como argumento: printf("%s", user_input). Implemente validação rigorosa de entrada e use análise estática de código para detectar padrões suspeitos.

CVE-2026-10828MEDIUMA format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-WEPSS 0.3%CVE-2025-68949MEDIUMn8n has a Webhook Node IP Whitelist Bypass via Partial String MatchingEPSS 0.3%CVE-2025-30269LOWQsync CentralEPSS 0.3%CVE-2026-50211HIGHExposed Factory Testing App BoundariesEPSS 0.3%CVE-2026-67244HIGHA format string vulnerability was found in the Notification OAuth settings of ADMEPSS 0.3%CVE-2023-36640MEDIUMA use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions,EPSS 0.3%CVE-2026-44407MEDIUMRemote Denial of Service Vulnerability Exists in ZTE Cloud PC Client uSmartviewEPSS 0.3%CVE-2025-24359HIGHASTEVAL Vulnerable to Maliciously Crafted Format Strings Leading to Sandbox EscapeEPSS 0.3%CVE-2026-73782HIGHUnauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CXEPSS 0.3%CVE-2026-18186HIGHA stored format string vulnerability was found in the FTP Backup on the ADMEPSS 0.3%CVE-2026-18188HIGHA format string vulnerability was found in the Rsync Backup on the ADMEPSS 0.3%CVE-2026-18187HIGHA format string vulnerability was found in the Internal Backup on the ADMEPSS 0.3%CVE-2024-23914MEDIUMUse of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MC_Open_Association() function is usEPSS 0.3%CVE-2023-23783MEDIUMA use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to EPSS 0.2%CVE-2022-43953MEDIUMA use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versionsEPSS 0.2%CVE-2026-21640LOWHackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific cEPSS 0.2%CVE-2023-40721MEDIUMA use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbiEPSS 0.2%CVE-2024-55156MEDIUMAn XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access senEPSS 0.2%CVE-2024-31837HIGHDMitry (Deepmagic Information Gathering Tool) 1.3a has a format-string vulnerability, with a threat model similar to CVE-2017-7938.EPSS 0.2%CVE-2023-41842MEDIUMA use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute unauEPSS 0.2%