Falhas do tipo CWE-843

682 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2023-50433MEDIUMmarshall in dhcp_packet.c in simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service by sending a malicious EPSS 0.3%CVE-2026-87636HIGHType confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sanEPSS 0.3%CVE-2026-45641HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-7988HIGHType Confusion in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.3%CVE-2026-8540HIGHType Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 0.3%CVE-2026-12298MEDIUMMemory safety bug fixed in Firefox 152EPSS 0.3%CVE-2026-12299MEDIUMJIT miscompilation in the DOM: Core & HTML componentEPSS 0.3%CVE-2026-16410CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.3%CVE-2026-68811HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-64904HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-68803HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-25204MEDIUMDeserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process aEPSS 0.3%CVE-2026-26162HIGHWindows OLE Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-13047HIGHAshlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-18701HIGHType Confusion in MongoDB Query Subsystem Leads to Denial of ServiceEPSS 0.3%CVE-2026-82057HIGHType Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of ServiceEPSS 0.3%CVE-2026-7927HIGHType Confusion in Runtime in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via aEPSS 0.3%CVE-2025-2197MEDIUMType Confusion Vulnerability in BrowserEPSS 0.3%CVE-2026-6363HIGHType Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access vEPSS 0.3%CVE-2022-32814HIGHA type confusion issue was addressed with improved state handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, EPSS 0.3%