Falhas do tipo CWE-704

81 resultados

Conversão ou casting incorreto de tipo

Ocorre quando o código converte um objeto ou dado de um tipo para outro de forma inadequada, sem validar se a conversão é segura ou se preserva a semântica esperada. Isso pode levar a interpretações erradas dos dados, corrupção de estado ou execução de código com privilégios indevidos.

Exemplo

Um aplicativo recebe um ponteiro genérico (void*) de rede e faz casting direto para uma estrutura específica sem verificar o tipo real. Se o servidor enviar dados de um tipo diferente, o acesso aos campos interpretará lixo de memória como valores válidos, causando lógica corrompida ou crash.

Como mitigar

Implemente validação de tipo antes de qualquer conversão (use type tags, discriminadores ou metadados). Prefira conversões explícitas que falham seguramente em vez de casts silenciosos; em linguagens como C, use structs com type identifiers ou serialize/desserialize com schema validation (JSON Schema, Protocol Buffers).

CVE-2025-41646CRITICALRevPi Webstatus application is vulnerable to an authentication bypassEPSS 44.0%CVE-2018-9940—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9938—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9937—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9942—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9941—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9939—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9943—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9936—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.7%CVE-2021-35942CRITICALThe wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) whEPSS 2.7%CVE-2021-39173HIGHForced reinstallEPSS 2.4%CVE-2020-16103HIGHType confusion in Gallagher Command Centre Server allows a remote attacker to crash the server or possibly cause remote code execution. ThisEPSS 2.2%CVE-2024-28130HIGHAn incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A speciaEPSS 1.7%CVE-2018-17913—A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an atEPSS 1.6%CVE-2020-6151HIGHA memory corruption vulnerability exists in the TIFF handle_COMPRESSION_PACKBITS functionality of Accusoft ImageGear 19.7. A specially craftEPSS 1.6%CVE-2022-41828HIGHIn Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check thEPSS 1.5%CVE-2019-12693MEDIUMCisco Adaptive Security Appliance Software Secure Copy Denial of Service VulnerabilityEPSS 1.5%CVE-2026-40613HIGHCoturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)EPSS 1.1%CVE-2021-3578—A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arEPSS 1.0%CVE-2024-39590HIGHMultiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a3EPSS 1.0%