Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2022-32915HIGHA type confusion issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary EPSS 0.3%CVE-2023-23455MEDIUMatm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusEPSS 0.3%CVE-2025-11731LOWLibxslt: type confusion in exsltfuncresultcompfunction of libxsltEPSS 0.3%CVE-2026-118510HIGHLaravel MongoDB `whereDoesntHave` misses deny records for numeric string IDsEPSS 0.3%CVE-2026-87564MEDIUMType confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML EPSS 0.3%CVE-2023-1077—In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry wilEPSS 0.3%CVE-2026-50491HIGHCode Integrity DLL (ci.dll) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-50390HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-6210HIGHType confusion and heap-buffer-overflow in Qt SVG marker handling causing application crashEPSS 0.3%CVE-2026-114115MEDIUMVyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array SelectionEPSS 0.3%CVE-2026-16111HIGHIBM DataPower Gateway Type ConfusionEPSS 0.3%CVE-2026-22028HIGHPreact has JSON VNode Injection issueEPSS 0.3%CVE-2026-8499MEDIUMHelpfulcrowd Product Reviews <= 1.2.9 - Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings UpdateEPSS 0.3%CVE-2025-29867HIGHAccess of Resource Using Incompatible Type ('Type Confusion') vulnerability in Hancom Inc. Hancom Office 2018, Hancom Inc. Hancom Office 202EPSS 0.3%CVE-2024-1848HIGHMultiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-9983HIGHType Confusion in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a cEPSS 0.3%CVE-2026-100793MEDIUMJIT miscompilation in the JavaScript Engine componentEPSS 0.3%CVE-2025-2015HIGHAshlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-2016HIGHAshlar-Vellum Cobalt VC6 File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-2022HIGHAshlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%