Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2024-26232HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-38219MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-72938MEDIUMMicrosoft Office PowerPoint Information Disclosure VulnerabilityEPSS 0.9%CVE-2025-29806MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-25933CRITICALA type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to EPSS 0.9%CVE-2023-23557CRITICALAn error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malEPSS 0.9%CVE-2026-10702MEDIUMJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.9%CVE-2026-77499HIGHWindows DHCP Server Denial of Service VulnerabilityEPSS 0.9%CVE-2026-77890HIGHWindows DHCP Server Denial of Service VulnerabilityEPSS 0.9%CVE-2022-21731MEDIUMType confusion leading to segfault in TensorflowEPSS 0.9%CVE-2026-77889HIGHWindows DHCP Server Denial of Service VulnerabilityEPSS 0.9%CVE-2026-77888HIGHWindows DHCP Server Denial of Service VulnerabilityEPSS 0.9%CVE-2026-64704CRITICALA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS EPSS 0.8%CVE-2024-1938HIGHType Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafteEPSS 0.8%CVE-2023-21675HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2024-9602HIGHType Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a craftEPSS 0.8%CVE-2023-22579CRITICALSequalize - Unsafe fall-through in getWhereConditionsEPSS 0.8%CVE-2026-28983HIGHA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, maEPSS 0.8%CVE-2026-64608CRITICALApache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsEPSS 0.8%CVE-2024-21363HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 0.8%