Falhas do tipo CWE-134

153 resultados

Uso de String de Formatação Controlada Externamente

Ocorre quando um programa usa entrada do usuário diretamente como argumento de formato em funções como printf(), sprintf() ou similares, sem validação. Um atacante pode injetar especificadores de formato (%x, %s, %n) para ler memória, derrubar a aplicação ou executar código arbitrário.

Exemplo

Um programa web recebe um parâmetro GET e faz printf(usuario_input) em vez de printf("%s", usuario_input). Um atacante envia ?name=%x%x%x e consegue vazar valores da pilha, ou usa %n para escrever na memória.

Como mitigar

Sempre use string de formato estática e fixa (literal), nunca construída a partir de entrada externa. Valide e sanitize qualquer dado de usuário antes de usá-lo em funções de formatação. Ferramentas como -Wformat-security do GCC ajudam a detectar isso em tempo de compilação.

CVE-2023-22923MEDIUMA format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authentiEPSS 0.8%CVE-2023-48784MEDIUMA use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all veEPSS 0.8%CVE-2023-53966CRITICALSOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer OverflowEPSS 0.7%CVE-2023-29181HIGHA use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 throEPSS 0.7%CVE-2011-10029HIGHSolar FTP Server <= 2.1.1 Malformed USER Denial of ServiceEPSS 0.7%CVE-2015-10088MEDIUMayttm proxy.c http_connect format stringEPSS 0.7%CVE-2024-45324HIGHA use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, veEPSS 0.7%CVE-2024-12805HIGHA post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads tEPSS 0.7%CVE-2023-2186HIGHOn Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message iEPSS 0.7%CVE-2023-45583MEDIUMA use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions,EPSS 0.7%CVE-2022-24051HIGHMariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate priviEPSS 0.7%CVE-2022-26393MEDIUMFormat String vulnerabilityEPSS 0.7%CVE-2023-6399MEDIUMA format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4EPSS 0.6%CVE-2024-50397HIGHQTS, QuTS heroEPSS 0.6%CVE-2022-26392LOWFormat String vulnerabilityEPSS 0.6%CVE-2024-50396HIGHQTS, QuTS heroEPSS 0.6%CVE-2024-45330MEDIUMA use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to EPSS 0.6%CVE-2022-3023MEDIUMUse of Externally-Controlled Format String in pingcap/tidbEPSS 0.6%CVE-2023-24590HIGH A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instaEPSS 0.6%CVE-2026-17136CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.6%