Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-49702HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-57975HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-58285HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-38218HIGHMicrosoft Edge (HTML-based) Memory Corruption VulnerabilityEPSS 0.6%CVE-2022-4205MEDIUMIn Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.EPSS 0.6%CVE-2026-1862HIGHType Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.6%CVE-2025-32948HIGHPeerTube ActivityPub Playlist Creation Blind SSRF and DoSEPSS 0.6%CVE-2025-30375HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-8385CRITICALA difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. ThEPSS 0.6%CVE-2026-55771HIGHCedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilitiesEPSS 0.6%CVE-2026-43037CRITICALip6_tunnel: clear skb2->cb[] in ip4ip6_err()EPSS 0.6%CVE-2025-53739HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-58592HIGHLadybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM IntegrationEPSS 0.5%CVE-2023-1215HIGHType confusion in CSS in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2026-66321HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-30383HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-15776HIGHInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sanEPSS 0.5%CVE-2023-42102HIGHAshlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-50176HIGHDirectX Graphics Kernel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-17687CRITICALType Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentEPSS 0.5%