Weakness (CWE)
CWE-134: Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
How to prevent it (3 mitigations)
-
Requirements
Choose a language that is not subject to this flaw.
-
Implementation
Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings. [REF-116] [REF-117]
-
Build and Compilation
Run compilers and linkers with high warning levels, since they may detect incorrect usage.
Source: MITRE CWE-134
85 results · Clear filters · Feed
-
High 7.7
QTS, QuTS hero
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data or modify memory. We …
-
High 7.5
Junos OS: SRX Series: If DNS traceoptions are configured in a DGA or tunnel detection scenario specific DNS traffic leads to a PFE crash
A Use of Externally-Controlled Format String vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If DNS Domain Generation Algorith…
-
High 8.8
Actiontec WCB6200Q Cookie Format String Remote Code Execution Vulnerability
Actiontec WCB6200Q Cookie Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. Authentication is not required to exploit this…
-
High 8.4
DMitry (Deepmagic Information Gathering Tool) 1.3a has a format-string vulnerability, with a threat model similar to CV…
-
High 8.3
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 throu…
-
High 8.1
A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 th…
-
High 7.5
A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory,…
-
High 7.0
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10,…
-
High 7.3
wire-avs remote format string vulnerability
wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability could potentially allow an attacker to cause a denial of service or possibly e…
-
High 8.8
ASUS RT-AX88U - externally-controlled format string
ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attacker can exploit the exported OpenVPN configuration to execute an externally-controlled format string a…
-
High 7.2
ASUS RT-AX55、RT-AX56U_V2 - Format String - 3
It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can ex…
-
High 7.2
ASUS RT-AX55、RT-AX56U_V2、RT-AC86U - Format String - 2
It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vul…
-
High 7.2
ASUS RT-AX55、RT-AX56U_V2 - Format String - 1
It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to …
-
High 8.8
TOTOLINK N200RE V5 Validity_check format string
A vulnerability classified as critical has been found in TOTOLINK N200RE V5 9.3.5u.6437_B20230519. This affects the function Validity_check. The manipulation leads to format string. It is possible to initiate the attack remotely. The root-cause of the vulnera…
-
High 7.2
ASUS RT-AX56U V2 & RT-AC86U - Format String -1
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker w…
-
High 8.8
A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firm…
-
High 8.2
On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafte…
-
High 7.3
Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary …
-
High 8.5CVE-2023-22374 EPSS 71%
iControl SOAP vulnerability
A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attac…
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
High 8.2
A format string injection vulnerability exists in the ghome_process_control_packet functionality of Abode Systems, Inc.…
-
High 7.5
Format String Vulnerability
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.
-
High 7.3
Use of Externally-Controlled Format String in umlaeute/v4l2loopback
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with…
-
High 7.0
MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attack…
-
High 8.8
WEIDMUELLER: WLAN devices affected by exploitable format string vulnerability
In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iw_console conio_writestr functionality. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in r…
-
High 7.5
Denial of Service in Tensorflow
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is…
-
High 8.1
PAN-OS on PA-7000 Series: Varrcvr daemon network-based denial of service or privilege escalation
A format string vulnerability in the Varrcvr daemon of PAN-OS on PA-7000 Series devices with a Log Forwarding Card (LFC) allows remote attackers to crash the daemon creating a denial of service condition or potentially execute code with root privileges. This …
-
High 8.1
PAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalation
A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code, bypassing the restricted shell and …
-
High 8.8
Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of st…
KEV Nov 3, 2021