Fallos del tipo CWE-843

808 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2025-47151CRITICALA type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specialEPSS 1.1%CVE-2022-2971HIGHMZ Automation libIEC61850 Access of Resource Using Incompatible Type ('Type Confusion')EPSS 1.1%CVE-2021-41041—In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is EPSS 1.1%CVE-2024-54505HIGHA type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.EPSS 1.1%CVE-2026-66321HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.1%CVE-2025-29791HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 1.1%CVE-2017-16745—A Type Confusion issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. An accessEPSS 1.1%CVE-2022-1786—A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with moreEPSS 1.0%CVE-2025-25000HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-43596MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2022-37377HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor 11.1.1.53537;. User interEPSS 1.0%CVE-2025-31206MEDIUMA type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7EPSS 1.0%CVE-2019-10980—A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attEPSS 1.0%CVE-2023-32664HIGHA type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. Specially crafted JEPSS 1.0%CVE-2026-54116MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 1.0%CVE-2024-34394HIGHlibxmljs2 namespaces type confusion RCEEPSS 1.0%CVE-2023-24823CRITICALRIOT-OS vulnerable to Packet Type Confusion during IPHC sendEPSS 1.0%CVE-2026-70167HIGHWindows Domain Name Service Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-50168HIGHWin32k Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2021-34866HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first EPSS 1.0%