Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2023-36578HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-9602HIGHType Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a craftEPSS 0.8%CVE-2026-65807HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-72984HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2022-3676MEDIUMIn Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of tEPSS 0.8%CVE-2026-59940CRITICALSeroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationEPSS 0.8%CVE-2023-22579CRITICALSequalize - Unsafe fall-through in getWhereConditionsEPSS 0.8%CVE-2025-49713HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-28983HIGHA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, maEPSS 0.8%CVE-2026-64608CRITICALApache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsEPSS 0.8%CVE-2024-21363HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-16919CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.8%CVE-2022-21734MEDIUM`CHECK`-failures in TensorflowEPSS 0.8%CVE-2026-106446CRITICALHandlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)EPSS 0.8%CVE-2026-4698HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.8%CVE-2025-50168HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-69717HIGHWindows Group Policy Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2024-30357HIGHFoxit PDF Reader AcroForm Annotation Type Confusion Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-43489MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2025-21356HIGHMicrosoft Office Visio Remote Code Execution VulnerabilityEPSS 0.8%