Fallos del tipo CWE-843

808 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-21519HIGHDesktop Window Manager Elevation of Privilege VulnerabilityEPSS 2.6%KEVCVE-2024-20678HIGHRemote Procedure Call Runtime Remote Code Execution VulnerabilityEPSS 2.5%CVE-2024-1939HIGHType Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 2.4%CVE-2021-41190LOWClarify Content-Type handling in OCI specEPSS 2.2%CVE-2010-4577HIGHThe CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS befoEPSS 2.2%CVE-2020-27293—Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a type confusion issue while processing project files, which may allow an attackeEPSS 2.1%CVE-2020-1911—A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prEPSS 2.0%CVE-2026-58289CRITICALMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-5946HIGHInvalid handling of CLASS != INEPSS 1.9%CVE-2024-20662MEDIUMWindows Online Certificate Status Protocol (OCSP) Information Disclosure VulnerabilityEPSS 1.9%CVE-2021-28643LOWAdobe Acrobat Pro DC embedDocAsDataObject Type Confusion Information Disclosure VulnerabilityEPSS 1.9%CVE-2026-33937CRITICALHandlebars.js has JavaScript Injection via AST Type ConfusionEPSS 1.9%CVE-2022-41033HIGHWindows COM+ Event System Service Elevation of Privilege VulnerabilityEPSS 1.9%KEVCVE-2020-27257—Omron CX-OneEPSS 1.9%CVE-2023-4352HIGHType confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 1.8%CVE-2022-42823HIGHA type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari EPSS 1.8%CVE-2026-85046HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 1.8%KEVCVE-2020-25661HIGHA Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with AEPSS 1.8%CVE-2023-5346HIGHType confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 1.7%CVE-2025-21225MEDIUMWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 1.7%