Fallos del tipo CWE-843

808 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-5865HIGHType Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.5%CVE-2024-5838HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted EPSS 0.5%CVE-2024-5833HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access viEPSS 0.5%CVE-2025-14799MEDIUMBrevo - Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type JugglingEPSS 0.5%CVE-2026-112606HIGHA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOSEPSS 0.5%CVE-2026-110674MEDIUMCpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hvEPSS 0.5%CVE-2024-8904HIGHType Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.5%CVE-2025-54104MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-24271MEDIUMAn access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS SequoEPSS 0.5%CVE-2024-5597HIGHFuji Electric Monitouch V-SFT Type ConfusionEPSS 0.5%CVE-2026-58295HIGHMicrosoft Edge (Chromium-based) Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2025-14330CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.5%CVE-2023-24599—OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbersEPSS 0.5%CVE-2024-9603HIGHType Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2026-96187HIGHMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 0.5%CVE-2024-7969HIGHType Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2026-15776HIGHInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sanEPSS 0.5%CVE-2026-14431HIGHType Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.5%CVE-2026-64727CRITICALA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26.6, tvOS 26.6. An app may be able tEPSS 0.5%CVE-2026-78938HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.5%