Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2022-1176HIGHLoose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchatEPSS 1.3%CVE-2025-7424HIGHLibxslt: type confusion in xmlnode.psvi between stylesheet and source nodesEPSS 1.2%CVE-2024-40803HIGHA type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13EPSS 1.2%CVE-2021-24045—A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that EPSS 1.2%CVE-2022-34709MEDIUMWindows Defender Credential Guard Security Feature Bypass VulnerabilityEPSS 1.2%CVE-2026-77494HIGHWindows DHCP Server Denial of Service VulnerabilityEPSS 1.2%CVE-2024-49119HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.2%CVE-2023-35356HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2024-6100HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (EPSS 1.1%CVE-2021-32965HIGHDelta Electronics DIAScreen - Type Confusion, Out-of-bounds WriteEPSS 1.1%CVE-2024-34392HIGHlibxmljs namespaces type confusion RCEEPSS 1.1%CVE-2023-35297HIGHWindows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityEPSS 1.1%CVE-2026-57108HIGH.NET Denial of Service VulnerabilityEPSS 1.1%CVE-2024-34391HIGHlibxmljs attrs type confusion RCEEPSS 1.1%CVE-2019-15792HIGHType confusion in shiftfsEPSS 1.1%CVE-2021-41041—In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is EPSS 1.1%CVE-2024-54505MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.EPSS 1.1%CVE-2022-2971HIGHMZ Automation libIEC61850 Access of Resource Using Incompatible Type ('Type Confusion')EPSS 1.1%CVE-2017-16745—A Type Confusion issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. An accessEPSS 1.1%CVE-2025-47151CRITICALA type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specialEPSS 1.1%