Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2025-47167HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-15646CRITICALHTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusionEPSS 0.7%CVE-2024-47804MEDIUMIf an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroEPSS 0.7%CVE-2023-1214HIGHType confusion in V8 in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.7%CVE-2024-7652HIGHType Confusion in Async Generators in Javascript EngineEPSS 0.7%CVE-2021-39987HIGHThe HwNearbyMain module has a Data Processing Errors vulnerability.Successful exploitation of this vulnerability may cause a process to restEPSS 0.7%CVE-2024-38209HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-61674CRITICALFluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handlerEPSS 0.7%CVE-2026-2796CRITICALJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.6%CVE-2026-69637MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 0.6%CVE-2026-69679MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 0.6%CVE-2026-16919CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.6%CVE-2022-3676MEDIUMIn Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of tEPSS 0.6%CVE-2024-10230HIGHType Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.6%CVE-2026-44628HIGHOFFIS DCMTK Toolkit Type ConfusionEPSS 0.6%CVE-2026-6732MEDIUMLibxml2: libxml2: denial of service via crafted xsd-validated documentEPSS 0.6%CVE-2024-56522HIGHAn issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function EPSS 0.6%CVE-2024-5158HIGHType Confusion in V8 in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to potentially perform arbitrary read/write via a craEPSS 0.6%CVE-2026-59940CRITICALSeroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationEPSS 0.6%CVE-2025-0147HIGHZoom Workplace App for Linux - Type ConfusionEPSS 0.6%