Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2021-1789HIGHA type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 CatalEPSS 14.0%KEVCVE-2022-1364HIGHType confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via EPSS 13.9%KEVCVE-2025-5959HIGHType Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 13.3%CVE-2017-11292HIGHAdobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be usEPSS 11.9%KEVCVE-2021-39841HIGHAdobe Acrobat Pro DC DocMedia Type Confusion Remote Code Execution VulnerabilityEPSS 11.7%CVE-2022-34221HIGHAdobe Acrobat Reader Type Confusion vulnerability could lead to Arbitrary code executionEPSS 11.1%CVE-2024-23222HIGHA type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and EPSS 10.6%KEVCVE-2020-27932HIGHA type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watEPSS 10.3%KEVCVE-2023-23529HIGHA type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1EPSS 9.4%KEVCVE-2025-53143HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 9.0%CVE-2021-30563HIGHType Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 9.0%KEVCVE-2025-10585HIGHType confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 9.0%KEVCVE-2024-4058CRITICALType confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 8.8%CVE-2021-31476HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. User interaEPSS 8.8%CVE-2023-46842MEDIUMx86 HVM hypercalls may trigger Xen bug checkEPSS 8.5%CVE-2022-42856HIGHA type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15EPSS 8.5%KEVCVE-2025-53145HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 8.5%CVE-2025-53144HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 8.5%CVE-2026-20860HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 8.3%CVE-2025-0291HIGHType Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 8.2%