Weakness (CWE)
CWE-134: Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
How to prevent it (3 mitigations)
-
Requirements
Choose a language that is not subject to this flaw.
-
Implementation
Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings. [REF-116] [REF-117]
-
Build and Compilation
Run compilers and linkers with high warning levels, since they may detect incorrect usage.
Source: MITRE CWE-134
185 results · Feed
-
High 8.8
A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firm…
-
Medium 6.3
A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0,…
-
High 8.2
On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafte…
-
Medium 4.4
Use of externally-controlled format string vulnerability in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows lo…
-
Medium 6.3
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined…
-
Medium 6.5
A format string vulnerability in a binary of the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could al…
-
Low 3.3
Git looks for localized messages in the wrong place
In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettex…
-
Medium 6.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-…
-
Medium 5.0
ayttm proxy.c http_connect format string
A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function http_connect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexi…
-
Medium 6.5
A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all version…
-
High 7.3
Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary …
-
Medium 6.5
IBM Spectrum Scale denial of service
IBM Spectrum Scale (5.1.0.0 through 5.1.2.8 and 5.1.3.0 through 5.1.5.1) and IBM Elastic Storage System (6.1.0.0 through 6.1.2.4 and 6.1.3.0 through 6.1.4.1) could allow an authenticated user to cause a denial of service through the GUI using a format string …
-
High 8.5CVE-2023-22374 EPSS 71%
iControl SOAP vulnerability
A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attac…
-
Medium 6.3
Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or cr…
-
Medium 4.2
Use of Externally-Controlled Format String in pingcap/tidb
Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3.
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 8.2
Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode …
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 7.1
Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
High 8.2
Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All…
-
Critical 9.8
A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-On…
-
High 8.2
A format string injection vulnerability exists in the ghome_process_control_packet functionality of Abode Systems, Inc.…
-
High 7.5
Format String Vulnerability
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.
-
Medium 5.0
Format String vulnerability
The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information or cause a Denial of Service (DoS) on the WBM.
-
Low 3.1
Format String vulnerability
The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive in…
-
Critical 9.8
A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to ac…
-
High 7.3
Use of Externally-Controlled Format String in umlaeute/v4l2loopback
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with…
-
Unscored —
A format string vulnerability was found in libinput
-
Critical 9.8
ASUS RT-AX88U - Format String
ASUS RT-AX88U has a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory address and perform remote arbitrary code execution, arbitrary system operation or disrupt service.
-
Critical 9.8
Use of Externally-Controlled Format String in consoleme
A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2
-
Critical 9.8
Use of Externally-Controlled Format String in wire-avs
wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been f…
-
High 7.0
MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attack…
-
Critical 9.8
Unprotected input value toString cause RCE
Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some othe…