Falhas do tipo CWE-704

104 resultados

Conversão ou casting incorreto de tipo

Ocorre quando o código converte um objeto ou dado de um tipo para outro de forma inadequada, sem validar se a conversão é segura ou se preserva a semântica esperada. Isso pode levar a interpretações erradas dos dados, corrupção de estado ou execução de código com privilégios indevidos.

Exemplo

Um aplicativo recebe um ponteiro genérico (void*) de rede e faz casting direto para uma estrutura específica sem verificar o tipo real. Se o servidor enviar dados de um tipo diferente, o acesso aos campos interpretará lixo de memória como valores válidos, causando lógica corrompida ou crash.

Como mitigar

Implemente validação de tipo antes de qualquer conversão (use type tags, discriminadores ou metadados). Prefira conversões explícitas que falham seguramente em vez de casts silenciosos; em linguagens como C, use structs com type identifiers ou serialize/desserialize com schema validation (JSON Schema, Protocol Buffers).

CVE-2025-41646CRITICALRevPi Webstatus application is vulnerable to an authentication bypassEPSS 50.9%CVE-2020-10735MEDIUMA flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could takeEPSS 4.5%CVE-2026-15826CRITICALUser Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' ParameterEPSS 3.9%CVE-2018-9943—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9940—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9942—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9938—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9937—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9939—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2018-9941—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.0%CVE-2021-35942CRITICALThe wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) whEPSS 2.8%CVE-2018-9936—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.6%CVE-2021-39173HIGHForced reinstallEPSS 2.4%CVE-2020-16103HIGHType confusion in Gallagher Command Centre Server allows a remote attacker to crash the server or possibly cause remote code execution. ThisEPSS 2.3%CVE-2022-41828HIGHIn Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check thEPSS 1.9%CVE-2024-28130HIGHAn incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A speciaEPSS 1.7%CVE-2018-17913—A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an atEPSS 1.6%CVE-2020-6151HIGHA memory corruption vulnerability exists in the TIFF handle_COMPRESSION_PACKBITS functionality of Accusoft ImageGear 19.7. A specially craftEPSS 1.6%CVE-2019-12693MEDIUMCisco Adaptive Security Appliance Software Secure Copy Denial of Service VulnerabilityEPSS 1.5%CVE-2010-20115CRITICALVermillion FTP <= 1.31 Daemon PORT Command Memory CorruptionEPSS 1.4%