Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-45600HIGHWindows Kernel-Mode Driver Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-11731LOWLibxslt: type confusion in exsltfuncresultcompfunction of libxsltEPSS 0.3%CVE-2026-34379HIGHOpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)EPSS 0.3%CVE-2026-74956CRITICALSame-origin policy bypass in the DOM: Service Workers componentEPSS 0.3%CVE-2025-7259MEDIUMCertain Queries with Duplicate _id Fields May Cause MongoDB Server to CrashEPSS 0.3%CVE-2026-50390HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-6210HIGHType confusion and heap-buffer-overflow in Qt SVG marker handling causing application crashEPSS 0.3%CVE-2026-50491HIGHCode Integrity DLL (ci.dll) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2023-1077—In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry wilEPSS 0.3%CVE-2025-66342HIGHA type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerabilitEPSS 0.3%CVE-2026-72766HIGHn8n before 1.123.67 Arbitrary File Read via Send Email NodeEPSS 0.3%CVE-2026-8499MEDIUMHelpfulcrowd Product Reviews <= 1.2.9 - Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings UpdateEPSS 0.3%CVE-2023-23455MEDIUMatm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusEPSS 0.3%CVE-2026-14644HIGHNexus Repository 3 - Privilege EscalationEPSS 0.3%CVE-2022-32915HIGHA type confusion issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary EPSS 0.3%CVE-2023-4194MEDIUMKernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuidEPSS 0.3%CVE-2024-1848HIGHMultiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024EPSS 0.3%CVE-2025-2016HIGHAshlar-Vellum Cobalt VC6 File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-2022HIGHAshlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-2015HIGHAshlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%