Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-6363HIGHType Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access vEPSS 0.3%CVE-2022-32814HIGHA type confusion issue was addressed with improved state handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, EPSS 0.3%CVE-2026-45600HIGHWindows Kernel-Mode Driver Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-74956CRITICALSame-origin policy bypass in the DOM: Service Workers componentEPSS 0.3%CVE-2025-11731LOWLibxslt: type confusion in exsltfuncresultcompfunction of libxsltEPSS 0.3%CVE-2026-34379HIGHOpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)EPSS 0.3%CVE-2025-7259MEDIUMCertain Queries with Duplicate _id Fields May Cause MongoDB Server to CrashEPSS 0.3%CVE-2026-50390HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50491HIGHCode Integrity DLL (ci.dll) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-6210HIGHType confusion and heap-buffer-overflow in Qt SVG marker handling causing application crashEPSS 0.3%CVE-2025-66342HIGHA type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerabilitEPSS 0.3%CVE-2023-1077—In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry wilEPSS 0.3%CVE-2026-72766HIGHn8n before 1.123.67 Arbitrary File Read via Send Email NodeEPSS 0.3%CVE-2026-8499MEDIUMHelpfulcrowd Product Reviews <= 1.2.9 - Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings UpdateEPSS 0.3%CVE-2023-23455MEDIUMatm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusEPSS 0.3%CVE-2022-32915HIGHA type confusion issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary EPSS 0.3%CVE-2023-4194MEDIUMKernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuidEPSS 0.3%CVE-2024-1848HIGHMultiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-25503HIGHiccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()EPSS 0.3%CVE-2025-2022HIGHAshlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%