Format String. Allowing an attacker to control a
function’s format string may result in a buffer overflow.
HTTP Response Splitting. Writing unvalidated data into
an HTTP header allows an attacker to specify the entirety