Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2023-28243HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.6%CVE-2023-41257HIGHA type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties. A specially crafted Javascript cEPSS 1.6%CVE-2025-21279MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-46152—A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application EPSS 1.6%CVE-2025-21225MEDIUMWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 1.6%CVE-2022-42823HIGHA type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari EPSS 1.5%CVE-2019-17639—In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the EPSS 1.5%CVE-2018-19019—A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior). An attacker could use a specEPSS 1.5%CVE-2026-85046HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 1.5%KEVCVE-2021-31344MEDIUMA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.5%CVE-2018-19027—Three type confusion vulnerabilities exist in CX-One Versions 4.50 and prior and CX-Protocol Versions 2.0 and prior when processing project EPSS 1.4%CVE-2021-31480HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2023-36887HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2023-48694MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 1.3%CVE-2025-21408HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.3%CVE-2025-24129HIGHA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS SonomaEPSS 1.3%CVE-2025-21326HIGHInternet Explorer Remote Code Execution VulnerabilityEPSS 1.3%CVE-2024-37987HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 1.3%CVE-2021-24044—By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would EPSS 1.3%CVE-2025-21342HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.3%