Fallos del tipo CWE-843

808 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-74956CRITICALSame-origin policy bypass in the DOM: Service Workers componentEPSS 0.5%CVE-2026-116489HIGHTimescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator ClassesEPSS 0.5%CVE-2023-2234MEDIUMBT HCI host union variant confusionEPSS 0.5%CVE-2026-25537MEDIUMjsonwebtoken has Type Confusion that leads to potential authorization bypassEPSS 0.5%CVE-2026-13967HIGHHeap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via EPSS 0.5%CVE-2022-48511—Use After Free (UAF) vulnerability in the audio PCM driver module under special conditions. Successful exploitation of this vulnerability maEPSS 0.5%CVE-2026-20811HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-13224HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2026-113192HIGHType confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.5%CVE-2025-54915MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-55772HIGHCedarJava has a type confusion vulnerabilityEPSS 0.5%CVE-2025-53808MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-54109MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-87528CRITICALType confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary codeEPSS 0.5%CVE-2024-5843HIGHInappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a mEPSS 0.5%CVE-2024-8638HIGHType Confusion in V8 in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit object corruption via a craftEPSS 0.5%CVE-2023-42105HIGHAshlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.5%CVE-2022-3903MEDIUMAn incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches EPSS 0.5%CVE-2023-44108HIGHType confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart.EPSS 0.5%CVE-2026-102556HIGHLibsoup: libsoup: heap buffer overflow from websocket pong signal type confusionEPSS 0.5%