Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-2022HIGHAshlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2023-4194MEDIUMKernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuidEPSS 0.3%CVE-2026-97737HIGHIn Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeoveEPSS 0.3%CVE-2026-17948HIGHType Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to exEPSS 0.3%CVE-2026-9117HIGHType Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the rendererEPSS 0.3%CVE-2026-86872MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciouslEPSS 0.3%CVE-2026-95380HIGHType confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute EPSS 0.3%CVE-2026-109720HIGHJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.3%CVE-2026-100792HIGHJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.3%CVE-2026-106433HIGHHeap corruption via duplicate masterKey fields in MongoDB libmongocryptEPSS 0.3%CVE-2026-34595MEDIUMParse Server: LiveQuery protected-field guard bypass via array-like logical operator valueEPSS 0.3%CVE-2024-20078CRITICALIn venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System executiEPSS 0.3%CVE-2025-7230HIGHINVT VT-Designer PM3 File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-13226HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.3%CVE-2025-13229HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.3%CVE-2025-13228HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.3%CVE-2025-13227HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.3%CVE-2025-13230HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.3%CVE-2026-106101LOWQuasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of ServiceEPSS 0.3%CVE-2026-43038CRITICALipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()EPSS 0.3%