Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2025-59717MEDIUMIn the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring maEPSS 0.4%CVE-2026-78956HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary coEPSS 0.4%CVE-2026-10955HIGHType Confusion in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds meEPSS 0.4%CVE-2024-11508HIGHIrfanView DXF File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-11507HIGHIrfanView DXF File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-14423CRITICALType Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a craftEPSS 0.4%CVE-2024-5271HIGHFuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion')EPSS 0.4%CVE-2025-22151LOWStrawberry GraphQL has a type resolution vulnerabilityEPSS 0.4%CVE-2026-44817HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-6301HIGHType Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox viaEPSS 0.4%CVE-2026-13066HIGHServer-Side JavaScript DBPointer BSON Serialization Memory DisclosureEPSS 0.4%CVE-2025-43297MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26. An app may be able to cause a denEPSS 0.4%CVE-2024-7825—Type confusion that can cause the WRSA.exe service to crash and generate a crash dumpEPSS 0.4%CVE-2026-6307HIGHType Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox viaEPSS 0.4%CVE-2024-53427HIGHdecNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-EPSS 0.4%CVE-2022-50590HIGHSuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' FunctionalityEPSS 0.4%CVE-2025-30445MEDIUMA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.EPSS 0.4%CVE-2024-13275MEDIUMSecurity Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039EPSS 0.4%CVE-2026-16420HIGHType Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox viaEPSS 0.4%CVE-2026-16392CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.4%