Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2020-10908HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interacEPSS 4.8%CVE-2020-10909HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interacEPSS 4.8%CVE-2020-10912HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interacEPSS 4.8%CVE-2026-40364HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 4.4%CVE-2024-8381CRITICALA potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environmenEPSS 4.4%CVE-2021-31461HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interactioEPSS 4.3%CVE-2021-30869HIGHA type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big SuEPSS 4.1%KEVCVE-2020-26990—A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected appliEPSS 3.9%CVE-2018-17685—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interactioEPSS 3.9%CVE-2019-13329HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5. User interaction is requEPSS 3.9%CVE-2019-6532—Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompaEPSS 3.8%CVE-2024-43498CRITICAL.NET and Visual Studio Remote Code Execution VulnerabilityEPSS 3.6%CVE-2021-33970CRITICALBuffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges.EPSS 3.1%CVE-2020-26980—A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applicatiEPSS 3.0%CVE-2020-13547HIGHA type confusion vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially craftEPSS 3.0%CVE-2020-16229—Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user EPSS 2.9%CVE-2018-14242—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 2.9%CVE-2018-11623—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 2.9%CVE-2020-25575CRITICALAn issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has EPSS 2.9%CVE-2018-14249—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interactioEPSS 2.8%