Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-47151CRITICALA type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specialEPSS 1.1%CVE-2021-41041—In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is EPSS 1.1%CVE-2022-2971HIGHMZ Automation libIEC61850 Access of Resource Using Incompatible Type ('Type Confusion')EPSS 1.1%CVE-2024-54505HIGHA type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.EPSS 1.1%CVE-2026-66321HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.1%CVE-2025-29791HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 1.1%CVE-2017-16745—A Type Confusion issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. An accessEPSS 1.1%CVE-2022-1786—A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with moreEPSS 1.0%CVE-2025-25000HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-43596MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-31206MEDIUMA type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7EPSS 1.0%CVE-2022-37377HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor 11.1.1.53537;. User interEPSS 1.0%CVE-2019-10980—A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attEPSS 1.0%CVE-2023-32664HIGHA type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. Specially crafted JEPSS 1.0%CVE-2026-54116MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 1.0%CVE-2024-34394HIGHlibxmljs2 namespaces type confusion RCEEPSS 1.0%CVE-2023-24823CRITICALRIOT-OS vulnerable to Packet Type Confusion during IPHC sendEPSS 1.0%CVE-2026-70167HIGHWindows Domain Name Service Remote Code Execution VulnerabilityEPSS 1.0%CVE-2021-34866HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first EPSS 1.0%CVE-2024-34393HIGHlibxmljs2 attrs type confusion RCEEPSS 1.0%