Fallos del tipo CWE-704

81 resultados

Conversão de tipo ou casting incorreto

Ocorre quando o código converte (faz cast de) um valor para um tipo de dado incompatível ou incorreto, sem validação adequada. Isso causa comportamento imprevisto: acesso a memória inválida, corrupção de dados, ou execução de código não autorizado, porque o programa interpreta bytes de forma errada.

Ejemplo

Um aplicativo recebe um objeto JSON como string, faz casting direto para um tipo de estrutura interna sem verificar se os campos existem ou têm o tipo esperado. Um atacante envia dados malformados, e a conversão permite ler ou escrever em áreas de memória sensíveis.

Cómo mitigar

Sempre valide dados antes de fazer casting: verifique o tipo real em tempo de execução (tipo dinâmico), use schemas ou validadores (JSON Schema, Protobuf), e prefira conversões seguras com tratamento de erro em vez de casts diretos. Em linguagens com tipagem forte, deixe o compilador fazer o trabalho.

CVE-2025-41646CRITICALRevPi Webstatus application is vulnerable to an authentication bypassEPSS 44.0%CVE-2018-9938—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9941—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9940—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9939—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9937—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9942—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9943—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9936—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.7%CVE-2021-35942CRITICALThe wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) whEPSS 2.7%CVE-2021-39173HIGHForced reinstallEPSS 2.4%CVE-2020-16103HIGHType confusion in Gallagher Command Centre Server allows a remote attacker to crash the server or possibly cause remote code execution. ThisEPSS 2.2%CVE-2024-28130HIGHAn incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A speciaEPSS 1.7%CVE-2018-17913—A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an atEPSS 1.6%CVE-2020-6151HIGHA memory corruption vulnerability exists in the TIFF handle_COMPRESSION_PACKBITS functionality of Accusoft ImageGear 19.7. A specially craftEPSS 1.6%CVE-2022-41828HIGHIn Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check thEPSS 1.5%CVE-2019-12693MEDIUMCisco Adaptive Security Appliance Software Secure Copy Denial of Service VulnerabilityEPSS 1.5%CVE-2026-40613HIGHCoturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)EPSS 1.1%CVE-2021-3578—A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arEPSS 1.0%CVE-2024-39590HIGHMultiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a3EPSS 1.0%