Fallos del tipo CWE-704

94 resultados

Conversão de tipo ou casting incorreto

Ocorre quando o código converte (faz cast de) um valor para um tipo de dado incompatível ou incorreto, sem validação adequada. Isso causa comportamento imprevisto: acesso a memória inválida, corrupção de dados, ou execução de código não autorizado, porque o programa interpreta bytes de forma errada.

Ejemplo

Um aplicativo recebe um objeto JSON como string, faz casting direto para um tipo de estrutura interna sem verificar se os campos existem ou têm o tipo esperado. Um atacante envia dados malformados, e a conversão permite ler ou escrever em áreas de memória sensíveis.

Cómo mitigar

Sempre valide dados antes de fazer casting: verifique o tipo real em tempo de execução (tipo dinâmico), use schemas ou validadores (JSON Schema, Protobuf), e prefira conversões seguras com tratamento de erro em vez de casts diretos. Em linguagens com tipagem forte, deixe o compilador fazer o trabalho.

CVE-2021-4456MEDIUMNet::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impactEPSS 0.3%CVE-2026-53798MEDIUMrsync < 3.5.0 Privilege Confusion via name-converter uid/gid mappingEPSS 0.3%CVE-2026-58822CRITICALIn multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code executiEPSS 0.3%CVE-2026-10080MEDIUMBoards plugin panics on WebSocket command with non-string field typesEPSS 0.3%CVE-2025-71002MEDIUMA floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) viEPSS 0.3%CVE-2026-34379HIGHOpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)EPSS 0.3%CVE-2026-28609HIGHIn read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution EPSS 0.3%CVE-2025-13720HIGHBad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentiallyEPSS 0.3%CVE-2026-25503HIGHiccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()EPSS 0.3%CVE-2026-22041LOWloggingredactor converts non-string types to string types in logsEPSS 0.3%CVE-2023-7345MEDIUMLedger Live hw-app-eth EIP-712 Message Parsing Integer TruncationEPSS 0.3%CVE-2026-42576MEDIUMapko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discoveryEPSS 0.3%CVE-2024-35303HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0012), Tecnomatix Plant Simulation V2404 (AllEPSS 0.3%CVE-2026-25613HIGHAn unsafe cast in the MongoDB query planner can result in a segmentation fault.EPSS 0.2%CVE-2026-50278MEDIUMiccDEV: CIccEmbedIO::Read8() size_t underflowEPSS 0.2%CVE-2026-24856HIGHiccDEV has UB runtime error in <icTagTypeSignature>EPSS 0.2%CVE-2023-45204HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (AllEPSS 0.2%CVE-2026-86348MEDIUMMS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin processEPSS 0.2%CVE-2026-6726HIGHAn information leakage vulnerability in the TCG TPM 2.0 reference code.EPSS 0.2%CVE-2022-49873MEDIUMbpf: Fix wrong reg type conversion in release_reference()EPSS 0.2%