Fallos del tipo CWE-843

808 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-62765HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-84563HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app EPSS 0.4%CVE-2026-10910HIGHType Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.4%CVE-2026-7337HIGHType Confusion in V8 in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 0.4%CVE-2026-14680HIGHPostgreSQL type confusion via "internal" argumentsEPSS 0.4%CVE-2026-14671HIGHPostgreSQL refint plan cache type confusion executes arbitrary codeEPSS 0.4%CVE-2026-70245HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-7824—Type-confusion vulnerability that can cause the WRSA.exe service to crash and generate a crash dumpEPSS 0.4%CVE-2026-33055MEDIUMtar-rs incorrectly ignores PAX size headers if header size is nonzeroEPSS 0.4%CVE-2026-8389HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.4%CVE-2026-43705HIGHA type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 EPSS 0.4%CVE-2024-49196HIGHAn issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400. Type confusion leads to a Denial of Service.EPSS 0.4%CVE-2023-51560HIGHFoxit PDF Reader Annotation Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-82057HIGHType Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of ServiceEPSS 0.4%CVE-2025-41738HIGHCODESYS Control - Invalid type usage in visualizationEPSS 0.4%CVE-2026-102323HIGHType confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2026-102299HIGHType confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2026-16238HIGHPostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary codeEPSS 0.4%CVE-2026-13883CRITICALType Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafEPSS 0.4%CVE-2026-70339MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.4%