Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2022-1176HIGHLoose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchatEPSS 1.3%CVE-2025-7424HIGHLibxslt: type confusion in xmlnode.psvi between stylesheet and source nodesEPSS 1.2%CVE-2024-40803HIGHA type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13EPSS 1.2%CVE-2021-24045—A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that EPSS 1.2%CVE-2022-34709MEDIUMWindows Defender Credential Guard Security Feature Bypass VulnerabilityEPSS 1.2%CVE-2026-77494HIGHWindows DHCP Server Denial of Service VulnerabilityEPSS 1.2%CVE-2024-49119HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.2%CVE-2023-35356HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2024-6100HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (EPSS 1.1%CVE-2021-32965HIGHDelta Electronics DIAScreen - Type Confusion, Out-of-bounds WriteEPSS 1.1%CVE-2024-34392HIGHlibxmljs namespaces type confusion RCEEPSS 1.1%CVE-2023-35297HIGHWindows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityEPSS 1.1%CVE-2026-57108HIGH.NET Denial of Service VulnerabilityEPSS 1.1%CVE-2024-34391HIGHlibxmljs attrs type confusion RCEEPSS 1.1%CVE-2019-15792HIGHType confusion in shiftfsEPSS 1.1%CVE-2021-41041—In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is EPSS 1.1%CVE-2024-54505MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.EPSS 1.1%CVE-2022-2971HIGHMZ Automation libIEC61850 Access of Resource Using Incompatible Type ('Type Confusion')EPSS 1.1%CVE-2017-16745—A Type Confusion issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. An accessEPSS 1.1%CVE-2025-47151CRITICALA type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specialEPSS 1.1%