Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2021-39219MEDIUMWrong type for `Linker`-define functions when used across two `Engine`sEPSS 0.4%CVE-2022-42841HIGHA type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 1EPSS 0.4%CVE-2026-21693HIGHiccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cppEPSS 0.4%CVE-2026-21692HIGHiccDEV has Type Confusion in ToXmlCurve() at IccXML/IccLibXML/IccMpeXml.cppEPSS 0.4%CVE-2026-11662HIGHType Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox viaEPSS 0.4%CVE-2026-79175HIGHType confusion in Accessibility in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the rendEPSS 0.4%CVE-2026-15572HIGHKeycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalationEPSS 0.4%CVE-2026-71644CRITICALAn issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trEPSS 0.4%CVE-2026-4457HIGHType Confusion in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.4%CVE-2024-12834HIGHDelta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-84635MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvEPSS 0.4%CVE-2021-46878HIGHAn issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug EPSS 0.4%CVE-2026-87528CRITICALType confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary codeEPSS 0.3%CVE-2026-13776CRITICALType Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentiEPSS 0.3%CVE-2026-35417HIGHWindows Win32k Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-12836HIGHDelta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14325HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.3%CVE-2026-20806MEDIUMWindows COM Server Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-1847HIGHMultiple vulnerabilities exist in file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-40683HIGHIn OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enableEPSS 0.3%