Weaknesses of type CWE-704

94 results

Tipo, versão ou conversão de tipo incorretos

Ocorre quando o código assume ou força uma conversão de tipo sem validar se o objeto é realmente do tipo esperado, ou quando trata uma versão de estrutura de dados como se fosse outra. Isso pode causar acesso a memória inválida, execução de código não autorizado ou corrupção de dados.

Example

Um serializador desserializa um objeto e o interpreta diretamente como uma classe específica sem verificar seu tipo real; se um atacante enviar um objeto de tipo diferente, o código acessa campos inexistentes ou executa métodos não previstos, causando crash ou fuga de dados.

How to mitigate

Sempre valide o tipo do objeto antes de conversão (use instanceof, type checks ou esquemas de validação). Implemente versionamento explícito de estruturas de dados e recuse desserializações de tipos inesperados. Em linguagens com segurança de tipo, prefira parsing explícito e tratamento de erros sobre conversões diretas.

CVE-2021-4456MEDIUMNet::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impactEPSS 0.3%CVE-2026-53798MEDIUMrsync < 3.5.0 Privilege Confusion via name-converter uid/gid mappingEPSS 0.3%CVE-2026-58822CRITICALIn multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code executiEPSS 0.3%CVE-2026-10080MEDIUMBoards plugin panics on WebSocket command with non-string field typesEPSS 0.3%CVE-2025-71002MEDIUMA floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) viEPSS 0.3%CVE-2026-34379HIGHOpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)EPSS 0.3%CVE-2026-28609HIGHIn read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution EPSS 0.3%CVE-2025-13720HIGHBad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentiallyEPSS 0.3%CVE-2026-25503HIGHiccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()EPSS 0.3%CVE-2026-22041LOWloggingredactor converts non-string types to string types in logsEPSS 0.3%CVE-2023-7345MEDIUMLedger Live hw-app-eth EIP-712 Message Parsing Integer TruncationEPSS 0.3%CVE-2026-42576MEDIUMapko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discoveryEPSS 0.3%CVE-2024-35303HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0012), Tecnomatix Plant Simulation V2404 (AllEPSS 0.3%CVE-2026-25613HIGHAn unsafe cast in the MongoDB query planner can result in a segmentation fault.EPSS 0.2%CVE-2026-50278MEDIUMiccDEV: CIccEmbedIO::Read8() size_t underflowEPSS 0.2%CVE-2026-24856HIGHiccDEV has UB runtime error in <icTagTypeSignature>EPSS 0.2%CVE-2023-45204HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (AllEPSS 0.2%CVE-2026-86348MEDIUMMS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin processEPSS 0.2%CVE-2026-6726HIGHAn information leakage vulnerability in the TCG TPM 2.0 reference code.EPSS 0.2%CVE-2022-49873MEDIUMbpf: Fix wrong reg type conversion in release_reference()EPSS 0.2%