Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2024-3298HIGHOut-Of-Bounds Write and Type Confusion vulnerabilities exist in the DWG and DXF file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-14148MEDIUMType Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from proEPSS 0.3%CVE-2026-113004HIGHType confusion in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted fiEPSS 0.3%CVE-2025-61911MEDIUMpython-ldap has sanitization bypass in ldap.filter.escape_filter_charsEPSS 0.3%CVE-2024-30266LOWWasmtime vulnerable to panic when using a dropped extenref-typed element segmentEPSS 0.3%CVE-2026-74976MEDIUMJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.3%CVE-2026-110140HIGHType confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2024-40788MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOSEPSS 0.3%CVE-2026-34344HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-11463MEDIUMUSCiLab Cereal Shared Pointer type confusionEPSS 0.3%CVE-2026-85377HIGHWindows CD-ROM Driver Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-11076HIGHType Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 0.3%CVE-2026-25503HIGHiccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()EPSS 0.3%CVE-2026-88090MEDIUMMicrosoft Edge (Chromium-based) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2023-50433MEDIUMmarshall in dhcp_packet.c in simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service by sending a malicious EPSS 0.3%CVE-2026-45641HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-7988HIGHType Confusion in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.3%CVE-2026-8540HIGHType Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 0.3%CVE-2026-79769HIGHNokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_argsEPSS 0.3%CVE-2026-12298MEDIUMMemory safety bug fixed in Thunderbird 152EPSS 0.3%