Fallos del tipo CWE-704

103 resultados

Conversão de tipo ou casting incorreto

Ocorre quando o código converte (faz cast de) um valor para um tipo de dado incompatível ou incorreto, sem validação adequada. Isso causa comportamento imprevisto: acesso a memória inválida, corrupção de dados, ou execução de código não autorizado, porque o programa interpreta bytes de forma errada.

Ejemplo

Um aplicativo recebe um objeto JSON como string, faz casting direto para um tipo de estrutura interna sem verificar se os campos existem ou têm o tipo esperado. Um atacante envia dados malformados, e a conversão permite ler ou escrever em áreas de memória sensíveis.

Cómo mitigar

Sempre valide dados antes de fazer casting: verifique o tipo real em tempo de execução (tipo dinâmico), use schemas ou validadores (JSON Schema, Protobuf), e prefira conversões seguras com tratamento de erro em vez de casts diretos. Em linguagens com tipagem forte, deixe o compilador fazer o trabalho.

CVE-2025-41646CRITICALRevPi Webstatus application is vulnerable to an authentication bypassEPSS 50.9%CVE-2020-10735MEDIUMA flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could takeEPSS 4.5%CVE-2026-15826CRITICALUser Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' ParameterEPSS 3.9%CVE-2018-9939—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9937—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9942—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9938—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9940—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9943—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9941—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2021-35942CRITICALThe wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) whEPSS 2.8%CVE-2018-9936—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.6%CVE-2021-39173HIGHForced reinstallEPSS 2.4%CVE-2020-16103HIGHType confusion in Gallagher Command Centre Server allows a remote attacker to crash the server or possibly cause remote code execution. ThisEPSS 2.3%CVE-2022-41828HIGHIn Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check thEPSS 1.9%CVE-2024-28130HIGHAn incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A speciaEPSS 1.7%CVE-2018-17913—A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an atEPSS 1.6%CVE-2020-6151HIGHA memory corruption vulnerability exists in the TIFF handle_COMPRESSION_PACKBITS functionality of Accusoft ImageGear 19.7. A specially craftEPSS 1.6%CVE-2019-12693MEDIUMCisco Adaptive Security Appliance Software Secure Copy Denial of Service VulnerabilityEPSS 1.5%CVE-2010-20115CRITICALVermillion FTP <= 1.31 Daemon PORT Command Memory CorruptionEPSS 1.4%