Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-22151LOWStrawberry GraphQL has a type resolution vulnerabilityEPSS 0.4%CVE-2025-55137HIGHLinkJoin through 882f196 mishandles lacks type checking in password reset.EPSS 0.4%CVE-2026-80183HIGHIn OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignmentEPSS 0.4%CVE-2026-10955HIGHType Confusion in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds meEPSS 0.4%CVE-2022-42841HIGHA type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 1EPSS 0.4%CVE-2026-113106HIGHType confusion in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain EPSS 0.4%CVE-2026-70225HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-11507HIGHIrfanView DXF File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-11508HIGHIrfanView DXF File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-30445MEDIUMA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.EPSS 0.4%CVE-2024-13275MEDIUMSecurity Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039EPSS 0.4%CVE-2026-96854MEDIUMWindows Device Association Service Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-79045HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory inside tEPSS 0.4%CVE-2024-5271HIGHFuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion')EPSS 0.4%CVE-2026-14423CRITICALType Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a craftEPSS 0.4%CVE-2026-85644HIGHXS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array referenceEPSS 0.4%CVE-2026-44817HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-6301HIGHType Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox viaEPSS 0.4%CVE-2026-84635MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvEPSS 0.4%CVE-2026-101912MEDIUMip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its rangeEPSS 0.4%