Falhas do tipo CWE-843

804 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2024-20678HIGHRemote Procedure Call Runtime Remote Code Execution VulnerabilityEPSS 2.5%CVE-2026-21519HIGHDesktop Window Manager Elevation of Privilege VulnerabilityEPSS 2.5%KEVCVE-2024-1939HIGHType Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 2.4%CVE-2021-41190LOWClarify Content-Type handling in OCI specEPSS 2.2%CVE-2010-4577HIGHThe CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS befoEPSS 2.2%CVE-2020-27293—Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a type confusion issue while processing project files, which may allow an attackeEPSS 2.1%CVE-2020-1911—A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prEPSS 2.0%CVE-2026-58289CRITICALMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 2.0%CVE-2026-5946HIGHInvalid handling of CLASS != INEPSS 1.9%CVE-2024-20662MEDIUMWindows Online Certificate Status Protocol (OCSP) Information Disclosure VulnerabilityEPSS 1.9%CVE-2021-28643LOWAdobe Acrobat Pro DC embedDocAsDataObject Type Confusion Information Disclosure VulnerabilityEPSS 1.9%CVE-2026-33937CRITICALHandlebars.js has JavaScript Injection via AST Type ConfusionEPSS 1.9%CVE-2022-41033HIGHWindows COM+ Event System Service Elevation of Privilege VulnerabilityEPSS 1.9%KEVCVE-2020-27257—Omron CX-OneEPSS 1.9%CVE-2023-4352HIGHType confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 1.8%CVE-2022-42823HIGHA type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari EPSS 1.8%CVE-2026-85046HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 1.8%KEVCVE-2020-25661HIGHA Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with AEPSS 1.8%CVE-2023-5346HIGHType confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 1.7%CVE-2025-21225MEDIUMWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 1.7%