Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-1920HIGHType Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.3%CVE-2026-14668HIGHPostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary readEPSS 0.3%CVE-2026-50421HIGHWindows Connected User Experiences and Telemetry Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-58541HIGHMicrosoft DWM Core Library Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-37603MEDIUMAn issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible type confusion exists in the user data import/export EPSS 0.3%CVE-2026-69324HIGHWindows Performance Monitor Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-70584HIGHWindows Core Messaging Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-61932HIGHWindows DWM Core Library Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-102328HIGHType confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2026-13803HIGHType Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to EPSS 0.3%CVE-2026-95306HIGHType confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2018-7530—Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prEPSS 0.3%CVE-2025-30310HIGHDreamweaver Desktop | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.3%CVE-2025-48756LOWIn group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.gEPSS 0.3%CVE-2026-91715HIGHType confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbEPSS 0.3%CVE-2026-102326HIGHType confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2026-103625HIGHType confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2026-95365HIGHType confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside tEPSS 0.3%CVE-2026-121166HIGHType confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via EPSS 0.3%CVE-2026-106293HIGHType confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentEPSS 0.3%