Przykłady dla CWE-134: Uncontrolled Format String

	Tytuł	Data	Autor
High	SOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer Overflow	12.02.2023	LiquidWorm
Med.	Slurp 1.10.2 Format String	15.02.2022	Milad Karimi
High	ABB IDAL HTTP Server Uncontrolled Format String	25.06.2019	Eldar Marcussen
High	Claymore Dual GPU Miner 10.5 Format String	03.02.2018	res1n
Med.	nsd Format String	18.12.2017	bashis
Low	OpenSSH 6.8 Insecure Functions	04.04.2015	NicholasL
Med.	War FTP Daemon Format String DoS (LIST command)	01.04.2014	corelanc0d3r
High	Tftpd32 Client Side Format String	04.12.2013	Fara Rustein
High	Flightgear 2.0 / 2.4 Format String	09.05.2013	Kurono
High	Polycom H.323 Format String	16.03.2013	Moritz Jodeit
High	VMWare OVF Tools Format String	07.02.2013	Juan vazquez
High	EMC NetWorker Format String	01.09.2012	Aaron Portnoy
High	XM Easy Personal FTP Server 5.30 Format String	15.06.2012	mr_me
High	ComSndFTP 1.3.7 Beta Format String Overflow	09.06.2012	Dark2S Security Team/H...
High	sudo 1.8.3p1 Format String	31.01.2012	Phenoelit Group
High	7T Interactive Graphical SCADA System Multiple Security Vulnerabilities	07.04.2011	Luigi Auriemma
High	rpc.pcnfsd Remote Format String Exploit	21.07.2010	Rodrigo Rubira Branco
High	HP OpenView Network Node Manager Arbitrary Code	24.05.2010	HP
Low	Ipswitch WS_FTP 12 Professional Remote Format String	23.04.2010	AKA
High	aria2 upstream 1.6.1 remote Denial of Service	22.10.2009	Jan Lieskovsky
Med.	VMware Authorization Service <= 2.5.3 (vmware-authd.exe) Format String DoS	16.10.2009	shinnai
Med.	Regular Expression Denial of Service	23.09.2009	Alex Roichman
High	i.Scribe SMTP Client <= 2.00b (wscanf) Remote Format String PoC	27.08.2009	grTs;SiD.psycho
High	Vietcong 2 Format String	25.08.2009	null
Med.	MySQL <= 5.0.45 post auth format string vulnerability	10.07.2009	Kingcope
High	Format String Vulnerability: FortiClient Version 3	11.04.2009	dh layereddefense com
High	Wireshark <= 1.0.6 PN-DCP Format String Exploit PoC	03.04.2009	THCX
Med.	GeoVision LiveAudio ActiveX Control GetAudioPlayingTime() remote freed-memory access	28.03.2009	trotzkista
High	Xitami Web Server v2.5c2 LRWP Processing Format String PoC	26.03.2009	bratax
High	BMC PatrolAgent Version Logging Format String Vulnerability	31.01.2009	Anonymous
High	WS_FTP Home/Professional FTP Client Remote Format String PoC	22.08.2008	securfrog
High	Format string vulnerability in 5th street	12.07.2008	Nam Nguyen

Common Weakness Enumeration (CWE)

CVE

Szczegóły

Opis

2024-04-09

CVE-2023-48784

Updating...

A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, version 7.0.14 and below, version 6.4.15 and below command line interface may allow a local privileged attacker with super-admin profile and CLI access to execute arbitrary code or commands via specially crafted requests.

2024-03-12

CVE-2023-41842

Updating...

A use of externally-controlled format string vulnerability [CWE-134] in Fortinet FortiManager version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer-BigData before 7.2.5 and Fortinet FortiPortal version 6.0 all versions and version 5.3 all versions allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments.

2024-02-22

CVE-2023-29181

Updating...

A use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.12, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted command.

2024-02-20

	CVE-2023-6399	Updating...	A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the �??deviceid�?� daemon by sending a crafted hostname to an affected device if it has the �??Device Insight�?� feature enabled.
	CVE-2023-6764	Updating...	A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device�??s memory layout and configuration.