Weaknesses of type CWE-843

684 results

Confusão de Tipos

Ocorre quando o programa trata uma variável ou objeto como se fosse de um tipo diferente do seu tipo real, levando a comportamentos impredizíveis. O atacante explora essa interpretação errada para contornar validações, corromper memória ou executar código arbitrário.

Example

Um aplicativo recebe um valor que valida como inteiro, mas a função que o processa o interpreta como um ponteiro de memória. O código tenta acessar e modificar dados no endereço apontado, causando corrupção ou exposição de informações sensíveis.

How to mitigate

Implemente validação rigorosa e conversão explícita de tipos antes de usar qualquer dado externo. Use linguagens com verificação forte de tipos em tempo de compilação e, quando necessário, valide tanto o tipo quanto o intervalo de valores esperados. Testes de fuzzing e análise estática ajudam a detectar confusões de tipo.

CVE-2019-11707HIGHA type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable EPSS 37.7%KEVCVE-2025-43541MEDIUMA type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.EPSS 34.1%CVE-2023-3079HIGHType confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 32.1%KEVCVE-2017-5070HIGHType confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attaEPSS 31.2%KEVCVE-2023-2724HIGHType confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 29.1%CVE-2024-21357HIGHWindows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityEPSS 26.9%CVE-2025-30397HIGHScripting Engine Memory Corruption VulnerabilityEPSS 26.8%KEVCVE-2023-36017HIGHWindows Scripting Engine Memory Corruption VulnerabilityEPSS 25.3%CVE-2026-21710HIGHA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the apEPSS 25.0%CVE-2022-1096HIGHType confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HEPSS 24.2%KEVCVE-2023-32439HIGHA type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7EPSS 24.0%KEVCVE-2023-2935HIGHType Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 23.9%CVE-2023-2936HIGHType Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 23.0%CVE-2024-7971HIGHType confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (EPSS 20.7%KEVCVE-2019-8506HIGHA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTEPSS 18.1%KEVCVE-2024-2887HIGHType Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTMLEPSS 17.9%CVE-2024-25575HIGHA type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object. A specially crafted JavascEPSS 17.7%CVE-2022-4262HIGHType confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 16.0%KEVCVE-2024-4947CRITICALType Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 15.2%KEVCVE-2021-1789HIGHA type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 CatalEPSS 14.5%KEV