Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-15646CRITICALHTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusionEPSS 0.7%CVE-2024-47804MEDIUMIf an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroEPSS 0.7%CVE-2023-1214HIGHType confusion in V8 in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.7%CVE-2025-49702HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.7%CVE-2024-7652HIGHType Confusion in Async Generators in Javascript EngineEPSS 0.7%CVE-2024-38209HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-15572HIGHKeycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalationEPSS 0.7%CVE-2026-96883HIGHType confusion in AWS pgcollection allows remote code executionEPSS 0.7%CVE-2026-71644CRITICALAn issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trEPSS 0.6%CVE-2026-69637MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 0.6%CVE-2026-69679MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 0.6%CVE-2026-1862HIGHType Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.6%CVE-2026-44628HIGHOFFIS DCMTK Toolkit Type ConfusionEPSS 0.6%CVE-2026-45764CRITICALSuricata http2: protocol-change type confusion can lead to denial of serviceEPSS 0.6%CVE-2026-6732MEDIUMLibxml2: libxml2: denial of service via crafted xsd-validated documentEPSS 0.6%CVE-2026-78904CRITICALType confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the EPSS 0.6%CVE-2026-78905HIGHType confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the EPSS 0.6%CVE-2024-56522HIGHAn issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function EPSS 0.6%CVE-2024-5158HIGHType Confusion in V8 in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to potentially perform arbitrary read/write via a craEPSS 0.6%CVE-2025-30375HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.6%