Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-11076HIGHType Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 0.3%CVE-2026-61932HIGHWindows DWM Core Library Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2023-50433MEDIUMmarshall in dhcp_packet.c in simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service by sending a malicious EPSS 0.3%CVE-2026-87636HIGHType confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sanEPSS 0.3%CVE-2026-45641HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-7988HIGHType Confusion in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.3%CVE-2026-12298MEDIUMMemory safety bug fixed in Firefox 152EPSS 0.3%CVE-2026-12299MEDIUMJIT miscompilation in the DOM: Core & HTML componentEPSS 0.3%CVE-2026-8540HIGHType Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 0.3%CVE-2026-16410CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.3%CVE-2026-68803HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-64904HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-68811HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-25204MEDIUMDeserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process aEPSS 0.3%CVE-2026-26162HIGHWindows OLE Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-13047HIGHAshlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-18701HIGHType Confusion in MongoDB Query Subsystem Leads to Denial of ServiceEPSS 0.3%CVE-2026-82057HIGHType Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of ServiceEPSS 0.3%CVE-2026-7927HIGHType Confusion in Runtime in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via aEPSS 0.3%CVE-2025-2197MEDIUMType Confusion Vulnerability in BrowserEPSS 0.3%