Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2022-21734MEDIUM`CHECK`-failures in TensorflowEPSS 0.8%CVE-2025-50168HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2022-3889HIGHType confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.8%CVE-2025-49713HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-30357HIGHFoxit PDF Reader AcroForm Annotation Type Confusion Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-43489MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-4698HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.8%CVE-2025-21356HIGHMicrosoft Office Visio Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-33938HIGHHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockEPSS 0.7%CVE-2024-7550HIGHType Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.7%CVE-2023-26063CRITICALCertain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type.EPSS 0.7%CVE-2026-50686HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-69717HIGHWindows Group Policy Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-33940HIGHHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialEPSS 0.7%CVE-2025-62518HIGHastral-tokio-tar Vulnerable to PAX Header DesynchronizationEPSS 0.7%CVE-2023-28162HIGHWhile implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentiallyEPSS 0.7%CVE-2023-24944MEDIUMWindows Bluetooth Driver Information Disclosure VulnerabilityEPSS 0.7%CVE-2024-43357HIGHJavaScript specification issue may lead to type confusion and pointer dereference in implementationsEPSS 0.7%CVE-2023-38128HIGHAn out-of-bounds write vulnerability exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted documentEPSS 0.7%CVE-2023-0473HIGHType Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruptioEPSS 0.7%