Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-53726HIGHWindows Push Notifications Apps Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-53724HIGHWindows Push Notifications Apps Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2023-42074HIGHPDF-XChange Editor addScript Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-42105HIGHAshlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-13169HIGHAn out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local auEPSS 0.4%CVE-2026-91741HIGHType confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandboEPSS 0.4%CVE-2026-91731HIGHType confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandboxEPSS 0.4%CVE-2026-58283HIGHMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.4%CVE-2026-65807HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-45762HIGHSuricata defrag: missing address-family check can lead to remote crashEPSS 0.4%CVE-2025-13630HIGHType Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.4%CVE-2026-45456HIGHMicrosoft Outlook and Word Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-53725HIGHWindows Push Notifications Apps Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-50155HIGHWindows Push Notifications Apps Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-93377HIGHType confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary coEPSS 0.4%CVE-2026-16363CRITICALJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.4%CVE-2025-62554HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-72984HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-52829HIGHZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address BookEPSS 0.4%CVE-2025-48815HIGHWindows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege VulnerabilityEPSS 0.4%