Fallos del tipo CWE-843

808 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2024-1938HIGHType Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafteEPSS 0.8%CVE-2023-36578HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-9602HIGHType Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a craftEPSS 0.8%CVE-2026-65807HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-72984HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2022-3676MEDIUMIn Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of tEPSS 0.8%CVE-2026-59940CRITICALSeroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationEPSS 0.8%CVE-2023-22579CRITICALSequalize - Unsafe fall-through in getWhereConditionsEPSS 0.8%CVE-2025-49713HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-28983HIGHA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, maEPSS 0.8%CVE-2026-64608CRITICALApache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsEPSS 0.8%CVE-2024-21363HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-16919CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.8%CVE-2022-21734MEDIUM`CHECK`-failures in TensorflowEPSS 0.8%CVE-2026-106446CRITICALHandlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)EPSS 0.8%CVE-2026-4698HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.8%CVE-2026-69717HIGHWindows Group Policy Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2024-30357HIGHFoxit PDF Reader AcroForm Annotation Type Confusion Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-43489MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-21356HIGHMicrosoft Office Visio Remote Code Execution VulnerabilityEPSS 0.8%