Falhas do tipo CWE-843

680 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-11662HIGHType Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox viaEPSS 0.4%CVE-2026-79175HIGHType confusion in Accessibility in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the rendEPSS 0.4%CVE-2026-15572HIGHKeycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalationEPSS 0.4%CVE-2024-53427HIGHdecNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-EPSS 0.4%CVE-2026-71644CRITICALAn issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trEPSS 0.4%CVE-2024-12834HIGHDelta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-4457HIGHType Confusion in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.4%CVE-2021-46878HIGHAn issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug EPSS 0.4%CVE-2026-87528CRITICALType confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary codeEPSS 0.3%CVE-2026-13776CRITICALType Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentiEPSS 0.3%CVE-2024-12836HIGHDelta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-35417HIGHWindows Win32k Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-84635MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvEPSS 0.3%CVE-2025-14325HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.3%CVE-2026-20806MEDIUMWindows COM Server Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-1847HIGHMultiple vulnerabilities exist in file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-40683HIGHIn OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enableEPSS 0.3%CVE-2026-54164MEDIUMAPI Platform Core: Missing IRI type check enables resource type confusionEPSS 0.3%CVE-2023-44094—Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart.EPSS 0.3%CVE-2026-13883CRITICALType Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafEPSS 0.3%