Fallos del tipo CWE-843

808 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-85898HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-33938HIGHHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockEPSS 0.7%CVE-2026-61674CRITICALFluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handlerEPSS 0.7%CVE-2026-33940HIGHHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialEPSS 0.7%CVE-2024-7550HIGHType Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.7%CVE-2023-26063CRITICALCertain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type.EPSS 0.7%CVE-2026-50686HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-47167HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-62518HIGHastral-tokio-tar Vulnerable to PAX Header DesynchronizationEPSS 0.7%CVE-2023-28162HIGHWhile implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentiallyEPSS 0.7%CVE-2023-38128HIGHAn out-of-bounds write vulnerability exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted documentEPSS 0.7%CVE-2026-19315CRITICALFireware OS Pre-Authentication Type Confusion in iked Allows Remote Code ExecutionEPSS 0.7%CVE-2026-4702CRITICALJIT miscompilation in the JavaScript Engine componentEPSS 0.7%CVE-2023-0473HIGHType Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruptioEPSS 0.7%CVE-2023-24944MEDIUMWindows Bluetooth Driver Information Disclosure VulnerabilityEPSS 0.7%CVE-2026-43037CRITICALip6_tunnel: clear skb2->cb[] in ip4ip6_err()EPSS 0.7%CVE-2026-16239HIGHPostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary codeEPSS 0.7%CVE-2024-43357HIGHJavaScript specification issue may lead to type confusion and pointer dereference in implementationsEPSS 0.7%CVE-2021-39987HIGHThe HwNearbyMain module has a Data Processing Errors vulnerability.Successful exploitation of this vulnerability may cause a process to restEPSS 0.7%CVE-2024-10230HIGHType Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.7%