Weaknesses of type CWE-134

144 results

Uso de string de formato controlada externamente

Ocorre quando a aplicação passa uma string vinda de entrada do usuário diretamente como argumento de formato em funções como printf(), sprintf() ou logging. Um atacante pode injetar especificadores de formato (%x, %s, %n) para ler ou escrever dados arbitrários na memória, comprometendo confidencialidade e integridade.

Example

Um programa web recebe um parâmetro 'nome' do usuário e faz `printf(nome)` em vez de `printf("%s", nome)`. Um atacante envia 'nome=%x.%x.%x' e consegue vazar dados da pilha; ou usa '%n' para sobrescrever endereços de memória.

How to mitigate

Nunca passe entrada do usuário diretamente como string de formato. Use sempre um formato fixo: `printf("%s", entrada_usuario)` em C, ou equivalente em outras linguagens. Em logs, sanitize ou use APIs de logging estruturado que não interpretam strings de formato.

CVE-2021-33535HIGHWEIDMUELLER: WLAN devices affected by exploitable format string vulnerabilityEPSS 1.6%CVE-2022-34747CRITICALA format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized reEPSS 1.5%CVE-2020-15634MEDIUMThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmwEPSS 1.4%CVE-2025-64157MEDIUMA use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2EPSS 1.4%CVE-2022-35244CRITICALA format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X aEPSS 1.3%CVE-2022-35886HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2022-35884HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2022-35887HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2022-35885HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2025-46121CRITICALAn issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addSEPSS 1.2%CVE-2024-6145HIGHActiontec WCB6200Q Cookie Format String Remote Code Execution VulnerabilityEPSS 1.2%CVE-2023-39238HIGHASUS RT-AX55、RT-AX56U_V2 - Format String - 1EPSS 1.2%CVE-2024-35845CRITICALwifi: iwlwifi: dbg-tlv: ensure NUL terminationEPSS 1.2%CVE-2023-39239HIGHASUS RT-AX55、RT-AX56U_V2、RT-AC86U - Format String - 2EPSS 1.2%CVE-2023-39240HIGHASUS RT-AX55、RT-AX56U_V2 - Format String - 3EPSS 1.2%CVE-2019-6840—A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server PluEPSS 1.1%CVE-2025-46123HIGHAn issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.EPSS 1.1%CVE-2023-35087CRITICALASUS RT-AX56U V2 & RT-AC86U - Format String - 2EPSS 1.1%CVE-2023-36639HIGHA use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4EPSS 1.1%CVE-2020-1979HIGHPAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalationEPSS 1.0%