Falhas do tipo CWE-134

170 resultados

Uso de String de Formatação Controlada Externamente

Ocorre quando um programa usa entrada do usuário diretamente como argumento de formato em funções como printf(), sprintf() ou similares, sem validação. Um atacante pode injetar especificadores de formato (%x, %s, %n) para ler memória, derrubar a aplicação ou executar código arbitrário.

Exemplo

Um programa web recebe um parâmetro GET e faz printf(usuario_input) em vez de printf("%s", usuario_input). Um atacante envia ?name=%x%x%x e consegue vazar valores da pilha, ou usa %n para escrever na memória.

Como mitigar

Sempre use string de formato estática e fixa (literal), nunca construída a partir de entrada externa. Valide e sanitize qualquer dado de usuário antes de usá-lo em funções de formatação. Ferramentas como -Wformat-security do GCC ajudam a detectar isso em tempo de compilação.

CVE-2024-50397HIGHQTS, QuTS heroEPSS 0.6%CVE-2024-45330MEDIUMA use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to EPSS 0.6%CVE-2023-24590HIGH A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instaEPSS 0.6%CVE-2026-101965HIGHJunos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabledEPSS 0.6%CVE-2024-50398LOWQTS, QuTS heroEPSS 0.6%CVE-2024-50399LOWQTS, QuTS heroEPSS 0.6%CVE-2024-50400LOWQTS, QuTS heroEPSS 0.6%CVE-2024-50401LOWQTS, QuTS heroEPSS 0.6%CVE-2026-12174HIGHD-Link DCS-935L HTTP rhea snprintf format stringEPSS 0.6%CVE-2024-58366CRITICALSurrealDB before 1.1.1 Format String via Scripting FunctionsEPSS 0.6%CVE-2026-76722CRITICALUncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APsEPSS 0.5%CVE-2024-50402LOWQTS, QuTS heroEPSS 0.5%CVE-2026-76753CRITICALUnauthenticated Format String Vulnerability in HPE Networking ClearPass Policy ManagerEPSS 0.5%CVE-2017-7519LOWIn Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service usinEPSS 0.5%CVE-2023-25492MEDIUMA valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a fEPSS 0.5%CVE-2026-67244HIGHA format string vulnerability was found in the Notification OAuth settings of ADMEPSS 0.5%CVE-2026-12004HIGHSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.5%CVE-2026-0400MEDIUMA post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.EPSS 0.5%CVE-2026-68553HIGHCoturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis CommandEPSS 0.5%CVE-2024-50403LOWQTS, QuTS heroEPSS 0.5%