Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2023-28243HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.6%CVE-2023-41257HIGHA type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties. A specially crafted Javascript cEPSS 1.6%CVE-2025-21279MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-46152—A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application EPSS 1.6%CVE-2025-21225MEDIUMWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 1.6%CVE-2022-42823HIGHA type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari EPSS 1.5%CVE-2019-17639—In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the EPSS 1.5%CVE-2018-19019—A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior). An attacker could use a specEPSS 1.5%CVE-2026-85046HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 1.5%KEVCVE-2021-31344MEDIUMA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.5%CVE-2018-19027—Three type confusion vulnerabilities exist in CX-One Versions 4.50 and prior and CX-Protocol Versions 2.0 and prior when processing project EPSS 1.4%CVE-2021-31480HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2023-36887HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2023-48694MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 1.3%CVE-2025-21408HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.3%CVE-2025-24129HIGHA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS SonomaEPSS 1.3%CVE-2025-21326HIGHInternet Explorer Remote Code Execution VulnerabilityEPSS 1.3%CVE-2024-37987HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 1.3%CVE-2021-24044—By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would EPSS 1.3%CVE-2025-21342HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.3%