Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-91715HIGHType confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbEPSS 0.3%CVE-2026-53600MEDIUMasync-tar PAX extension-header desync enables tar entry/content smugglingEPSS 0.3%CVE-2026-17989HIGHType Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.3%CVE-2026-79045HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory inside tEPSS 0.3%CVE-2024-3298HIGHOut-Of-Bounds Write and Type Confusion vulnerabilities exist in the DWG and DXF file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.3%CVE-2025-61911MEDIUMpython-ldap has sanitization bypass in ldap.filter.escape_filter_charsEPSS 0.3%CVE-2026-85051HIGHType confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandboxEPSS 0.3%CVE-2026-14148MEDIUMType Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from proEPSS 0.3%CVE-2026-74976MEDIUMJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.3%CVE-2025-12899MEDIUMnet: icmp: Out of bound memory readEPSS 0.3%CVE-2024-30266LOWWasmtime vulnerable to panic when using a dropped extenref-typed element segmentEPSS 0.3%CVE-2026-69324HIGHWindows Performance Monitor Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-70584HIGHWindows Core Messaging Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-87612HIGHType confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2025-30310HIGHDreamweaver Desktop | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.3%CVE-2024-40788MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOSEPSS 0.3%CVE-2026-34344HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-48756LOWIn group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.gEPSS 0.3%CVE-2026-11463MEDIUMUSCiLab Cereal Shared Pointer type confusionEPSS 0.3%CVE-2023-23454MEDIUMcbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds readEPSS 0.3%