Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-7259MEDIUMCertain Queries with Duplicate _id Fields May Cause MongoDB Server to CrashEPSS 0.3%CVE-2024-12836HIGHDelta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-104846CRITICALSeroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)EPSS 0.3%CVE-2026-35417HIGHWindows Win32k Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-8010HIGHType Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.3%CVE-2026-5871HIGHType Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.3%CVE-2025-14325HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.3%CVE-2023-23454MEDIUMcbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds readEPSS 0.3%CVE-2026-117890HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.3%CVE-2026-20806MEDIUMWindows COM Server Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-102321HIGHType confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2025-8011HIGHType Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.3%CVE-2024-1847HIGHMultiple vulnerabilities exist in file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.3%CVE-2025-32352MEDIUMA type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for useEPSS 0.3%CVE-2026-40683HIGHIn OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enableEPSS 0.3%CVE-2026-95286HIGHType confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox viEPSS 0.3%CVE-2026-54164MEDIUMAPI Platform Core: Missing IRI type check enables resource type confusionEPSS 0.3%CVE-2026-22046HIGHiccDEV has heap-buffer-overflow in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cppEPSS 0.3%CVE-2026-86922HIGHA type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden GaEPSS 0.3%CVE-2026-14668HIGHPostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary readEPSS 0.3%