Fallos del tipo CWE-843

808 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-32701HIGHQwik has array method pollution in FormData processing, allowing type confusion and DoSEPSS 0.5%CVE-2026-76047HIGHType confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a cEPSS 0.5%CVE-2026-79209HIGHType confusion in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside tEPSS 0.5%CVE-2026-79236HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.5%CVE-2026-78956HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary coEPSS 0.5%CVE-2026-17989HIGHType Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.5%CVE-2026-87636HIGHType confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sanEPSS 0.5%CVE-2026-17725HIGHType Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.5%CVE-2026-85051HIGHType confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandboxEPSS 0.5%CVE-2026-87612HIGHType confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.5%CVE-2026-79227HIGHType confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrEPSS 0.5%CVE-2026-76038HIGHType confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a cEPSS 0.5%CVE-2024-11346HIGHAccess of Resource Using Incompatible Type in Postscript interpreterEPSS 0.4%CVE-2025-70023CRITICALAn issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6.EPSS 0.4%CVE-2023-42074HIGHPDF-XChange Editor addScript Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-53724HIGHWindows Push Notifications Apps Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-53726HIGHWindows Push Notifications Apps Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-53600MEDIUMasync-tar PAX extension-header desync enables tar entry/content smugglingEPSS 0.4%CVE-2026-91741HIGHType confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandboEPSS 0.4%CVE-2026-72766HIGHn8n before 1.123.67 Arbitrary File Read via Send Email NodeEPSS 0.4%