Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-102556HIGHLibsoup: libsoup: heap buffer overflow from websocket pong signal type confusionEPSS 0.5%CVE-2026-55024HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2024-9859HIGHType confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTMEPSS 0.5%CVE-2026-55025HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-68803HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-55022HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.5%CVE-2024-8194HIGHType Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2023-38074HIGHA vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), TeamcenEPSS 0.5%CVE-2026-64904HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-68811HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-113193MEDIUMType confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.5%CVE-2025-53810MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-54094MEDIUMWindows Defender Firewall Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-21854CRITICALTarkov Data Manager Authentication Bypass vulnerabilityEPSS 0.5%CVE-2026-109733HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.5%CVE-2026-70017MEDIUMWindows Secure Kernel Mode Information Disclosure VulnerabilityEPSS 0.5%CVE-2025-48815HIGHWindows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-13630HIGHType Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.5%CVE-2024-11344HIGHType confusion vulnerability in the Postscript interpreter in various Lexmark devicesEPSS 0.5%CVE-2026-113044HIGHType confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.5%