Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2025-13229HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.2%CVE-2025-22435CRITICALIn avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of EPSS 0.2%CVE-2026-35541MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to tyEPSS 0.2%CVE-2026-5496HIGHLabcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.2%CVE-2024-54524MEDIUMA logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to access arEPSS 0.2%CVE-2026-80185MEDIUMBluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as rootEPSS 0.2%CVE-2026-70339MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-43355MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, mEPSS 0.2%CVE-2026-0162HIGHIn ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code executioEPSS 0.2%CVE-2026-40446MEDIUMAccess of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.ThisEPSS 0.2%CVE-2024-13049HIGHAshlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-11196MEDIUMType Confusion in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from proEPSS 0.2%CVE-2023-6045MEDIUMArkruntime has a type confusion vulnerabilityEPSS 0.2%CVE-2026-80183HIGHIn OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignmentEPSS 0.2%CVE-2023-37376HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (AllEPSS 0.2%CVE-2026-8358MEDIUMHeap buffer overflow in spreadsheet tracked-changes importEPSS 0.2%CVE-2026-7914HIGHType Confusion in Accessibility in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker who had compromised the rendereEPSS 0.2%CVE-2025-66586HIGHType Confusion vulnerability in AzeoTech DAQFactoryEPSS 0.2%CVE-2025-7230HIGHINVT VT-Designer PM3 File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-21330HIGHAfter Effects | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.2%