Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-85898HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-33938HIGHHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockEPSS 0.7%CVE-2026-61674CRITICALFluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handlerEPSS 0.7%CVE-2026-33940HIGHHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialEPSS 0.7%CVE-2024-7550HIGHType Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.7%CVE-2023-26063CRITICALCertain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type.EPSS 0.7%CVE-2026-50686HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-47167HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-62518HIGHastral-tokio-tar Vulnerable to PAX Header DesynchronizationEPSS 0.7%CVE-2023-28162HIGHWhile implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentiallyEPSS 0.7%CVE-2023-38128HIGHAn out-of-bounds write vulnerability exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted documentEPSS 0.7%CVE-2026-19315CRITICALFireware OS Pre-Authentication Type Confusion in iked Allows Remote Code ExecutionEPSS 0.7%CVE-2026-4702CRITICALJIT miscompilation in the JavaScript Engine componentEPSS 0.7%CVE-2023-0473HIGHType Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruptioEPSS 0.7%CVE-2023-24944MEDIUMWindows Bluetooth Driver Information Disclosure VulnerabilityEPSS 0.7%CVE-2026-43037CRITICALip6_tunnel: clear skb2->cb[] in ip4ip6_err()EPSS 0.7%CVE-2026-16239HIGHPostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary codeEPSS 0.7%CVE-2024-43357HIGHJavaScript specification issue may lead to type confusion and pointer dereference in implementationsEPSS 0.7%CVE-2021-39987HIGHThe HwNearbyMain module has a Data Processing Errors vulnerability.Successful exploitation of this vulnerability may cause a process to restEPSS 0.7%CVE-2024-10230HIGHType Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.7%