CWE-134 Use of Externally-Controlled Format String
Description
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-134 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-3m6g-2423-7cp3 | CVE-2026-33210 | HIGH |
Ruby JSON has a format string injection vulnerability |
2026-03-25 | |
| GHSA-w96v-gf22-crwp | CVE-2025-68949 | MODERATE |
n8n: Webhook Node IP Whitelist Bypass via Partial String Matching |
2026-01-13 | |
| GHSA-9ccg-6pjw-x645 | CVE-2025-55298 | HIGH |
nuget/Magick.NET-Q16-AnyCPU
nuget/Magick.NET-Q16-HDRI-AnyCPU
nuget/Magick.NET-Q16-HDRI-OpenMP-arm64
nuget/Magick.NET-Q16-HDRI-OpenMP-x64
nuget/Magick.NET-Q16-HDRI-arm64
nuget/Magick.NET-Q16-HDRI-x64
nuget/Magick.NET-Q16-HDRI-x86
nuget/Magick.NET-Q16-OpenMP-arm64
nuget/Magick.NET-Q16-OpenMP-x64
nuget/Magick.NET-Q16-arm64
nuget/Magick.NET-Q16-x64
nuget/Magick.NET-Q16-x86
nuget/Magick.NET-Q8-AnyCPU
nuget/Magick.NET-Q8-OpenMP-arm64
nuget/Magick.NET-Q8-OpenMP-x64
nuget/Magick.NET-Q8-arm64
nuget/Magick.NET-Q8-x64
nuget/Magick.NET-Q8-x86
|
ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution |
2025-11-03 |
| GHSA-hrfh-7j5f-8ccr | CVE-2019-11287 | HIGH | - |
Pivotal RabbitMQ is vulnerable to a denial of service attack |
2025-04-02 |
| GHSA-3wwr-3g9f-9gc7 | CVE-2025-24359 | HIGH |
ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape |
2025-01-25 | |
| GHSA-xmq7-7fxm-rr79 | CVE-2020-15203 | HIGH |
Denial of Service in Tensorflow |
2024-10-28 | |
| GHSA-p5wr-vp8g-q5p4 | CVE-2017-5524 | MODERATE |
Plone Sandbox Escape |
2024-10-18 | |
| GHSA-hj2j-77xm-mc5v | CVE-2016-10745 | HIGH |
Jinja2 sandbox escape vulnerability |
2024-09-24 | |
| GHSA-5rp4-749p-vx26 | CVE-2022-40604 | HIGH |
Apache Airflow vulnerable to Use of Externally-Controlled Format String |
2024-09-11 | |
| GHSA-f9fr-w54q-772h | CVE-2006-0743 | MODERATE |
Apache log4net format string vulnerability causes DoS |
2024-02-09 | |
| GHSA-wwh7-4jw9-33x6 | CVE-2017-16516 | HIGH |
yajl-ruby gem Denial of Service vulnerability |
2023-08-29 | |
| GHSA-rg5m-3fqp-6px8 | CVE-2013-4389 | MODERATE |
actionmailer email address processing causes Denial of service |
2023-07-04 | |
| GHSA-32v7-ghpr-c8hg | CVE-2019-15547 | HIGH | - |
Mishandling of format strings in ncurses |
2023-06-13 |
| GHSA-xgj6-pgrm-x4r2 | CVE-2007-6183 | MODERATE |
gtk2 vulnerable to Use of Externally-Controlled Format String |
2023-01-26 | |
| GHSA-7fxj-fr3v-r9gj | CVE-2022-3023 | CRITICAL |
TiDB vulnerable to Use of Externally-Controlled Format String |
2022-11-24 | |
| GHSA-74w3-2r77-fw5h | CVE-2022-27177 | CRITICAL |
Use of Externally-Controlled Format String in consoleme |
2022-04-18 | |
| GHSA-2j6v-xpf3-xvrv | CVE-2021-41193 | HIGH |
Use of Externally-Controlled Format String in wire-avs |
2022-03-10 | |
| GHSA-qvm7-23cj-437v | CVE-2021-36161 | CRITICAL |
Remote Code Execution in Apache Dubbo |
2021-09-20 | |
| GHSA-8r7q-r9mx-35rh | CVE-2020-35869 | CRITICAL | - |
Mishandling of format strings in rusqlite |
2021-08-19 |
| GHSA-m57c-4vvx-gjgq | CVE-2019-15546 | HIGH | - |
Format string vulnerabilities in pancurses |
2021-08-18 |