Fallos del tipo CWE-843

808 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-91731HIGHType confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandboxEPSS 0.4%CVE-2026-58283HIGHMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.4%CVE-2026-121057HIGHType confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2024-11395HIGHType Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.4%CVE-2026-79175HIGHType confusion in Accessibility in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the rendEPSS 0.4%CVE-2024-13169HIGHAn out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local auEPSS 0.4%CVE-2026-113949HIGHA type confusion issue was addressed with improved state management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 2EPSS 0.4%CVE-2026-45456HIGHMicrosoft Outlook and Word Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-53725HIGHWindows Push Notifications Apps Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-50155HIGHWindows Push Notifications Apps Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-93377HIGHType confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary coEPSS 0.4%CVE-2026-16363CRITICALJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.4%CVE-2025-62554HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-31968HIGHHTSlib CRAM decoder vulnerable to buffer overflowEPSS 0.4%CVE-2026-115892MEDIUMWasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload typeEPSS 0.4%CVE-2026-5360MEDIUMFree5GC aper type confusionEPSS 0.4%CVE-2026-58290HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-113098MEDIUMType confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code insidEPSS 0.4%CVE-2025-24213HIGHThis issue was addressed with improved handling of floats. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOEPSS 0.4%CVE-2026-62765HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.4%