Falhas do tipo CWE-134

144 resultados

Uso de String de Formatação Controlada Externamente

Ocorre quando um programa usa entrada do usuário diretamente como argumento de formato em funções como printf(), sprintf() ou similares, sem validação. Um atacante pode injetar especificadores de formato (%x, %s, %n) para ler memória, derrubar a aplicação ou executar código arbitrário.

Exemplo

Um programa web recebe um parâmetro GET e faz printf(usuario_input) em vez de printf("%s", usuario_input). Um atacante envia ?name=%x%x%x e consegue vazar valores da pilha, ou usa %n para escrever na memória.

Como mitigar

Sempre use string de formato estática e fixa (literal), nunca construída a partir de entrada externa. Valide e sanitize qualquer dado de usuário antes de usá-lo em funções de formatação. Ferramentas como -Wformat-security do GCC ajudam a detectar isso em tempo de compilação.

CVE-2023-22374HIGHiControl SOAP vulnerabilityEPSS 72.6%CVE-2024-23113CRITICALA use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FoEPSS 61.7%KEVCVE-2019-1579HIGHRemote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or EPSS 46.0%KEVCVE-2023-35086HIGHASUS RT-AX56U V2 & RT-AC86U - Format String -1EPSS 38.5%CVE-2020-3118HIGHCisco IOS XR Software Cisco Discovery Protocol Format String VulnerabilityEPSS 11.7%KEVCVE-2017-0898—Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus valEPSS 9.7%CVE-2019-13318MEDIUMThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.5.0.20723. User intEPSS 5.8%CVE-2025-48826HIGHA format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP rEPSS 4.4%CVE-2025-55298HIGHImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code executionEPSS 4.4%CVE-2020-1992HIGHPAN-OS on PA-7000 Series: Varrcvr daemon network-based denial of service or privilege escalationEPSS 3.4%CVE-2023-4746HIGHTOTOLINK N200RE V5 Validity_check format stringEPSS 3.2%CVE-2021-32785MEDIUMFormat string bug in the Redis cache implementationEPSS 2.7%CVE-2022-26674CRITICALASUS RT-AX88U - Format StringEPSS 2.6%CVE-2017-3859—A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow anEPSS 2.5%CVE-2021-41193CRITICALUse of Externally-Controlled Format String in wire-avsEPSS 2.5%CVE-2022-3724MEDIUMCrash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file onEPSS 2.3%CVE-2017-12702—An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiersEPSS 2.3%CVE-2021-20307—Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary mEPSS 1.9%CVE-2012-10055CRITICALComSndFTP v1.3.7 Beta USER Format String RCEEPSS 1.6%CVE-2022-40604HIGHFormat String VulnerabilityEPSS 1.6%