CWE-134: Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- postgresql psqlodbc psqlODBC uses a server-supplied column name as a format string 6.8 Medium
- cesnet netopeer2 netopeer2-server logging has format string vulnerability via subtree filter 7.1 High
- unitronics unistream pro/unilogic Unitronics - CWE-134 Use of Externally-Controlled format string 8.3 High
- juniper networks junos os Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is used 9.2 Critical
- juniper networks junos os evolved Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled 8.7 High
- juniper networks junos os evolved Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service 8.8 High
- microsoft sql server 2017 (gdr), sql server 2017 for x64-based systems (cu31), sql server 2019 (gdr) +5 more +7 more Microsoft SQL Server Denial of Service Vulnerability 4.9 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Windows NTFS Elevation of Privilege Vulnerability 7.8 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +13 more +15 more Windows Image Acquisition Elevation of Privilege Vulnerability 7.8 High
- hewlett packard enterprise (hpe) clearpass policy manager (cppm) Unauthenticated Format String Vulnerability in HPE Networking ClearPass Policy Manager 9.8 Critical
- asus router Use of an Externally Controlled Format String in the ASUS Router modules allow a remote... 9.4 Critical
- nvidia geforce, rtx, quadro, nvs, tesla +2 more NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause... 7.8 High
- hewlett packard enterprise (hpe) instant on Authenticated Format String Vulnerability allows Memory Corruption in HPE Networking Instant ON API Endpoint 6.6 Medium
- hewlett packard enterprise (hpe) instant on Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs 9.8 Critical
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 more Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an admin… 8.7 High
- rti connext professional Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection. 9.2 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 more Active Directory Certificate Services (AD CS) Information Disclosure Vulnerability 6.5 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 more Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX 8.8 High
- ibm aix, powervm vios, vios +2 more Vulnerabilities in IBM AIX and PowerVM VIOS 7.0 High
- wibu-systems-ag codemeter-runtime Format String Vulnerability in Logger 8.2 High
- openssl Untrusted Sender DN Used as Format String in CMP Response Validation 9.8 Critical
- ibm aix, powervm vios, vios +2 more Vulnerabilities in IBM AIX and PowerVM VIOS 9.8 Critical
- coturn Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command 7.1 High
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +17 more +19 more Power System Information Disclosure 5.2 Medium
- ibm security verify access, verify identity access, verify identity access container +1 more +3 more Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 8.7 High
- asustor inc. adm, asustor data master +1 more A format string vulnerability was found in the Notification OAuth settings of ADM 8.6 High
- asustor inc. adm, asustor data master +1 more A format string vulnerability was found in the Rsync Backup on the ADM 7.1 High
- asustor inc. adm, asustor data master +1 more A format string vulnerability was found in the Internal Backup on the ADM 7.1 High
- asustor inc. adm, asustor data master +1 more A stored format string vulnerability was found in the FTP Backup on the ADM 7.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 more Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling. 6.8 Medium
- red hat confidential compute attestation, openshift container platform 4, openshift container platform 4.12 +11 more +13 more Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env 7.8 High
- lorex 2k indoor wi-fi security camera Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability 7.5 High
- dell powerprotect data domain, data domain operating system +1 more Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0... 5.5 Medium
- geovision inc. gv-lpclpc2011/2211 GV-LPC2011/LPC2211 - unauthorized format string vulnerability (vlsvr) 8.6 High
- moxa nport w2150a-w4/w2250a-w4 series, nport w2150a/w2250a series +1 more A format string vulnerability has been found in the "alias" parameter of the Serial Param... 6.9 Medium
- nokia sr linux An unsanitized format validation vulnerability in Nokia SR Linux 6.3 Medium
- d-link dcs-935l, dlink dcs-935l firmware +1 more D-Link DCS-935L HTTP rhea snprintf format string 8.7 High
- tp-link tapo c110 firmware, tp-link systems inc. tapo c110 v2 +1 more Authenticated Format String Injection on TP-Link Tapo C110 7.0 High
- tp-link systems inc. tapo c520ws v2 Authenticated Format String Vulnerability in ONVIF Subscribe Service on TP-Link Tapo C520WS 6.8 Medium
- tp-link systems inc. tapo c520ws v2 Authenticated Format String Vulnerability in ONVIF AddScopes Method on TP-Link Tapo C520WS 6.8 Medium
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 more Exposed Factory Testing App Boundaries 8.8 High
- netatalk Format string argument mismatch 3.1 Low
- postgresql PostgreSQL timeofday() can disclose portions of server memory 4.3 Medium
- zte zxcloud irai Remote Denial of Service Vulnerability Exists in ZTE Cloud PC Client uSmartview 4.7 Medium
- notepad++, notepad-plus-plus notepad\+\+ +1 more Notepad++ 8.9.3 Format String Injection via nativeLang.xml 4.6 Medium
- notepad++ Vulnerability in Notepad++ 6.6 Medium
- gnu nano, red hat enterprise linux 10, enterprise linux 6 +6 more +8 more Nano: nano: format string vulnerability leads to denial of service 5.5 Medium
- codesys control for beaglebone sl, control for empc-a/imx6 sl, control for iot2000 sl +12 more +14 more CODESYS Control Audit Log Format String DoS 7.5 High
- ruby json, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +6 more +8 more Ruby JSON has a format string injection vulnerability 8.3 High
- fortinet fortianalyzer, fortianalyzer cloud, fortimanager +1 more +3 more A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0... 6.5 Medium
- Show olderLoading…