Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-21854CRITICALTarkov Data Manager Authentication Bypass vulnerabilityEPSS 0.5%CVE-2025-54094MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-54109MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-53810MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-43506HIGHA logic error was addressed with improved error handling. This issue is fixed in macOS Tahoe 26.1. iCloud Private Relay may not activate wheEPSS 0.5%CVE-2025-53808MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-55025HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-55022HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-55024HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2023-38074HIGHA vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), TeamcenEPSS 0.5%CVE-2024-9859HIGHType confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTMEPSS 0.5%CVE-2025-13224HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2022-3903MEDIUMAn incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches EPSS 0.5%CVE-2024-8194HIGHType Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2026-25537MEDIUMjsonwebtoken has Type Confusion that leads to potential authorization bypassEPSS 0.5%CVE-2026-19315CRITICALFireware OS Pre-Authentication Type Confusion in iked Allows Remote Code ExecutionEPSS 0.5%CVE-2024-11344HIGHType confusion vulnerability in the Postscript interpreter in various Lexmark devicesEPSS 0.5%CVE-2026-14431HIGHType Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.5%CVE-2025-70023CRITICALAn issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6.EPSS 0.4%CVE-2024-11346HIGHAccess of Resource Using Incompatible Type in Postscript interpreterEPSS 0.4%