CWE-134: Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- netapp data ontapNetApp Data ONTAP before 8.2.5 and 8.3.x before 8.3.2P12 allow remote authenticated users to...6.5 Medium
- advantech webaccessAn Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior...8.8 High
- perforce puppet enterprise, puppet enterprise +1 moreThe console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads...8.8 High
- rsyslogThe zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as...9.8 Critical
- invisible-island ncursesIn ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input...9.8 Critical
- bavarian motor works bluetooth stackThe Bluetooth stack on the BMW 330i 2011 allows a remote crash of the CD/Multimedia software via ...7.5 High
- dena h2oH2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a...7.5 High
- gnu a2psFormat string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.7.8 High
- cloudviewnms cloudview nmsCloudView NMS before 2.10a has a format string issue exploitable over SNMP.9.8 Critical
- dell integrated remote access controller firmwareDell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue...9.8 Critical
- apple mac os xAn issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue...8.8 High
- plonePlone Sandbox Escape4.3 Medium
- cisco ios xeA vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series...7.5 High
- cpanel cgiecho, cgiemail +1 moreFormat string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary...7.8 High
- xmlsoft libxml2, apple icloud, iphone os +15 more +17 moreFormat string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact...9.8 Critical
- phpFormat string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP...9.8 Critical
- idera uptime infrastructure monitorFormat string vulnerability in the up.time client in Idera Uptime Infrastructure Monitor 6.0 and...5.3 Medium
- latex2rtf project latex2rtf, fedoraproject fedora +1 moreFormat string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10...7.8 High
- cisco email security applianceFormat string vulnerability in Cisco Email Security Appliance (ESA) 7.6.0 and 8.0.0 allows remote...6.4 Medium
- debian dpkgMultiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg...6.8 Medium
- rrdtool project rrdtoolFormat string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows...5.0 Medium
- graphviz, debian linux +1 moreFormat string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows...7.5 High
- universityofcalifornia boinc clientFormat string vulnerability in the PROJECT::write_account_file function in client/cs_account.cpp...5.0 Medium
- apple mac os xFormat string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows...6.8 Medium
- jgaa warftpdFormat string vulnerability in War FTP Daemon (warftpd) 1.82 RC 12 allows remote authenticated...4.0 Medium
- condor project condor, fedoraproject fedora, redhat enterprise mrg +2 moreMultiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x...4.4 Medium
- skybluecanvasThe bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in...6.8 Medium
- redhat certificate system, dogtag certificate system +1 moreFormat string vulnerability in the token processing system (pki-tps) in Red Hat Certificate...7.5 High
- philippe jounin tftpd32Format string vulnerability in the client in Tftpd32 before 4.50 allows remote servers to cause a...5.0 Medium
- apple remote desktop, mac os x +1 moreFormat string vulnerability in Screen Sharing Server in Apple Mac OS X before 10.9 and Apple...7.5 High
- rubyonrails rails, debian linux, opensuse +2 moreactionmailer email address processing causes Denial of service4.3 Medium
- radscan network audio systemFormat string vulnerability in the osLogMsg function in server/os/aulog.c in Network Audio System...7.5 High
- yard radius project radiusMultiple format string vulnerabilities in Yet Another Radius Daemon (YARD RADIUS) 1.1.2 allow...7.5 High
- wireshark, debian linux, opensuse +2 moreThe dissect_dsmcc_un_download function in epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC...5.0 Medium
- emc alphastorFormat string vulnerability in the _vsnsprintf function in rrobotd.exe in the Device Manager in...7.6 High
- mcryptMultiple format string vulnerabilities in mcrypt 2.6.8 and earlier might allow user-assisted...6.8 Medium
- vmware ovf tool, player, workstation +2 moreFormat string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x...9.3 High
- emc networkerFormat string vulnerability in the nsrd RPC service in EMC NetWorker 7.6.3 and 7.6.4 before 7.6.4...9.3 High
- microsoft windows 7, windows server 2003, windows server 2008 +2 more +4 moreFormat string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3,...10.0 High
- flightgear, simgear +1 moreMultiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier...9.3 High
- cypherpunks pidgin-otrFormat string vulnerability in the log_message_cb function in otr-plugin.c in the Off-the-Record...7.5 High
- debian linux, linux kernel, canonical ubuntu linux +2 moreFormat string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main...6.9 Medium
- linux kernelFormat string vulnerability in the register_disk function in block/genhd.c in the Linux kernel...6.0 Medium
- ingy yaml\Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML ...5.0 Medium
- perlMultiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl)...5.0 Medium
- apple iphone osFormat string vulnerability in VPN in Apple iOS before 5.1 allows remote attackers to execute...9.3 High
- advantech webaccessFormat string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to...10.0 High
- todd miller sudoFormat string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local...7.2 High
- brandon long clearsilverFormat string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit...7.5 High
- apple mac os x, mac os x server +1 moreFormat string vulnerability in the debug-logging feature in Application Firewall in Apple Mac OS...4.4 Medium
- Show moreLoading…