Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-5865HIGHType Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.5%CVE-2024-9603HIGHType Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2025-54104MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-81401MEDIUMMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.5%CVE-2023-2234MEDIUMBT HCI host union variant confusionEPSS 0.5%CVE-2026-13967HIGHHeap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via EPSS 0.5%CVE-2026-20811HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2024-10231HIGHType Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.5%CVE-2026-26110HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-64727CRITICALA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26.6, tvOS 26.6. An app may be able tEPSS 0.5%CVE-2022-48511—Use After Free (UAF) vulnerability in the audio PCM driver module under special conditions. Successful exploitation of this vulnerability maEPSS 0.5%CVE-2025-24271MEDIUMAn access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS SequoEPSS 0.5%CVE-2025-54915MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-14799MEDIUMBrevo - Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type JugglingEPSS 0.5%CVE-2026-55772HIGHCedarJava has a type confusion vulnerabilityEPSS 0.5%CVE-2026-78905HIGHType confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the EPSS 0.5%CVE-2026-78904CRITICALType confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the EPSS 0.5%CVE-2026-4702CRITICALJIT miscompilation in the JavaScript Engine componentEPSS 0.5%CVE-2024-5843HIGHInappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a mEPSS 0.5%CVE-2024-8638HIGHType Confusion in V8 in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit object corruption via a craftEPSS 0.5%