Falhas do tipo CWE-134

154 resultados

Uso de String de Formatação Controlada Externamente

Ocorre quando um programa usa entrada do usuário diretamente como argumento de formato em funções como printf(), sprintf() ou similares, sem validação. Um atacante pode injetar especificadores de formato (%x, %s, %n) para ler memória, derrubar a aplicação ou executar código arbitrário.

Exemplo

Um programa web recebe um parâmetro GET e faz printf(usuario_input) em vez de printf("%s", usuario_input). Um atacante envia ?name=%x%x%x e consegue vazar valores da pilha, ou usa %n para escrever na memória.

Como mitigar

Sempre use string de formato estática e fixa (literal), nunca construída a partir de entrada externa. Valide e sanitize qualquer dado de usuário antes de usá-lo em funções de formatação. Ferramentas como -Wformat-security do GCC ajudam a detectar isso em tempo de compilação.

CVE-2026-10828MEDIUMA format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-WEPSS 0.3%CVE-2025-68949MEDIUMn8n has a Webhook Node IP Whitelist Bypass via Partial String MatchingEPSS 0.3%CVE-2025-30269LOWQsync CentralEPSS 0.3%CVE-2026-50211HIGHExposed Factory Testing App BoundariesEPSS 0.3%CVE-2026-67244HIGHA format string vulnerability was found in the Notification OAuth settings of ADMEPSS 0.3%CVE-2023-36640MEDIUMA use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions,EPSS 0.3%CVE-2026-44407MEDIUMRemote Denial of Service Vulnerability Exists in ZTE Cloud PC Client uSmartviewEPSS 0.3%CVE-2025-24359HIGHASTEVAL Vulnerable to Maliciously Crafted Format Strings Leading to Sandbox EscapeEPSS 0.3%CVE-2026-73782HIGHUnauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CXEPSS 0.3%CVE-2026-18186HIGHA stored format string vulnerability was found in the FTP Backup on the ADMEPSS 0.3%CVE-2026-18188HIGHA format string vulnerability was found in the Rsync Backup on the ADMEPSS 0.3%CVE-2026-18187HIGHA format string vulnerability was found in the Internal Backup on the ADMEPSS 0.3%CVE-2024-23914MEDIUMUse of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MC_Open_Association() function is usEPSS 0.3%CVE-2023-23783MEDIUMA use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to EPSS 0.2%CVE-2022-43953MEDIUMA use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versionsEPSS 0.2%CVE-2026-21640LOWHackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific cEPSS 0.2%CVE-2023-40721MEDIUMA use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbiEPSS 0.2%CVE-2024-55156MEDIUMAn XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access senEPSS 0.2%CVE-2024-31837HIGHDMitry (Deepmagic Information Gathering Tool) 1.3a has a format-string vulnerability, with a threat model similar to CVE-2017-7938.EPSS 0.2%CVE-2023-41842MEDIUMA use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute unauEPSS 0.2%