Fallos del tipo CWE-843

808 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2020-10889HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interacEPSS 4.8%CVE-2020-10909HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interacEPSS 4.8%CVE-2020-10912HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interacEPSS 4.8%CVE-2026-40364HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 4.4%CVE-2024-8381CRITICALA potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environmenEPSS 4.4%CVE-2021-31461HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 4.3%CVE-2021-30869HIGHA type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big SuEPSS 4.2%KEVCVE-2020-26990—A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected appliEPSS 4.1%CVE-2018-17685—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.9%CVE-2019-13329HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5. User interaction is requEPSS 3.9%CVE-2019-6532—Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompaEPSS 3.8%CVE-2024-43498CRITICAL.NET and Visual Studio Remote Code Execution VulnerabilityEPSS 3.6%CVE-2020-26980—A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applicatiEPSS 3.2%CVE-2021-33970CRITICALBuffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges.EPSS 3.1%CVE-2020-13547HIGHA type confusion vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially craftEPSS 3.0%CVE-2020-25575CRITICALAn issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has EPSS 2.9%CVE-2020-16229—Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user EPSS 2.9%CVE-2018-14242—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 2.8%CVE-2018-11623—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 2.8%CVE-2020-6656MEDIUMFile parsing Type Confusion Remote code execution vulerabilityEPSS 2.8%