CWE-134: Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- apache airflowFormat String Vulnerability7.5 High
- baxter spectrum wireless battery module (wbm), spectrum iq 35700bax3 firmware, sigma spectrum 35700bax2 firmware +2 more +4 moreFormat String vulnerability5.0 Medium
- baxter spectrum wireless battery module (wbm), spectrum iq 35700bax3 firmware, sigma spectrum 35700bax2 firmware +2 more +4 moreFormat String vulnerability3.1 Low
- zyxel nas326 firmwareA format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could...9.8 Critical
- redhat openshift api managementA flaw was found in the Red Hat OpenShift API Management product. User input is not validated...5.4 Medium
- fortinet fortiadc, fortimail, fortios +2 more +4 moreA format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0...7.8 High
- umlaeute umlaeute/v4l2loopback, v4l2loopback project v4l2loopback +1 moreUse of Externally-Controlled Format String in umlaeute/v4l2loopback7.3 High
- huawei emui, harmonyos, magic ui +2 moreThe voice wakeup module has a vulnerability of using externally-controlled format strings....7.5 High
- asus rt-ax88u, rt-ax88u firmware +1 moreASUS RT-AX88U - Format String9.8 Critical
- freedesktop libinputA format string vulnerability was found in libinput7.8 High
- netflix consolemeUse of Externally-Controlled Format String in consoleme9.8 Critical
- draytek vigor2960 firmware, vigor300b firmware, vigor3900 firmware +2 moreA Format String vulnerability exists in DrayTek Vigor 2960 <= 1.5.1.3, DrayTek Vigor 3900 <= 1.5...9.8 Critical
- wireapp wire-avs, wire wire-audio video signaling +1 moreUse of Externally-Controlled Format String in wire-avs9.8 Critical
- mariadb, fedoraproject fedora +1 moreThis vulnerability allows local attackers to escalate privileges on affected installations of...7.0 High
- kaseya unitrends backupAn issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A crafted HTTP...8.8 High
- arubanetworks aruba instant, siemens scalance w1750d firmware +1 moreA remote denial of service vulnerability was discovered in Aruba Instant version(s): Aruba...5.3 Medium
- samsung android, mobile devices, samsung mobile devices +2 moreAssuming radio permission is gained, missing input validation in modem interface driver prior to...3.3 Low
- apache dubboUnprotected input value toString cause RCE9.8 Critical
- bbraun spacecom2An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows...8.1 High
- trendnet tew-755ap2kac firmware, tew-755ap firmware, tew-821dap2kac firmware +1 more +3 moreA Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW...6.5 Medium
- debian linux, netapp cloud backup, openidc mod auth openidc +2 moreFormat string bug in the Redis cache implementation5.3 Medium
- tcl** DISPUTED ** In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code...7.8 High
- weidmueller ie-wl-bl-ap-cl-eu firmware, ie-wl-bl-ap-cl-us firmware, ie-wl-vl-ap-br-cl-eu firmware +7 more +9 moreWEIDMUELLER: WLAN devices affected by exploitable format string vulnerability8.8 High
- ibm spectrum scaleIBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is...8.4 High
- mpvA format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to...7.8 High
- rust-lang rust, fedoraproject fedora +1 moreIn the standard library in Rust before 1.50.3, there is an optimization for joining strings that...8.2 High
- libpano13, debian linux, fedoraproject fedora +2 moreFormat string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and...9.8 Critical
- fortinet fortiwebA format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote...8.8 High
- mersive solstice pod firmwareSolstice-Pod up to 5.0.2 WEBRTC server mishandles the format-string specifiers %x; %p; %c and %s...7.5 High
- audi mmi multiplayerOn Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7 MMI Multiplayer with version (N...7.1 High
- wire, wire secure messenger, - audio\, video\, and signaling +2 moreWire before 2020-10-16 allows remote attackers to cause a denial of service (application crash)...9.8 Critical
- google tensorflow, opensuse leap +1 moreDenial of Service in Tensorflow7.5 High
- mercedes-benz comandOn Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles ...3.5 Low
- netgear r6700, r6700 firmware +1 moreThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected...6.3 Medium
- anydeskAnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited...9.8 Critical
- rusqlite project rusqliteUse after free in rusqlite9.8 Critical
- rusqlite project rusqliteImproper type usage in rusqlite9.8 Critical
- rusqlite project rusqliteData races in rusqlite8.1 High
- rusqlite project rusqliteUse after free in rusqlite9.8 Critical
- rusqlite project rusqliteMishandling of format strings in rusqlite9.8 Critical
- rusqlite project rusqliteData races in rusqlite9.8 Critical
- rusqlite project rusqliteData races in rusqlite9.8 Critical
- rusqlite project rusqliteData races in rusqlite9.8 Critical
- palo alto networks pan-osPAN-OS on PA-7000 Series: Varrcvr daemon network-based denial of service or privilege escalation8.1 High
- palo alto networks pan-osPAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalation8.1 High
- moxa awk-3131a firmware, moxa +1 moreAn exploitable format string vulnerability exists in the iw_console conio_writestr functionality...8.8 High
- zenoss core, debian linux +1 moreMultiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core...7.5 High
- cisco ios xr software, ios xr +1 moreCisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability8.8 High
- open tftp server project tftp serverFormat string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows...9.8 Critical
- open tftp server project tftp serverFormat string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows...9.8 Critical
- Show moreLoading…