Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2024-1939HIGHType Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 2.6%CVE-2024-20678HIGHRemote Procedure Call Runtime Remote Code Execution VulnerabilityEPSS 2.5%CVE-2026-21519HIGHDesktop Window Manager Elevation of Privilege VulnerabilityEPSS 2.5%KEVCVE-2021-41190LOWClarify Content-Type handling in OCI specEPSS 2.2%CVE-2010-4577HIGHThe CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS befoEPSS 2.2%CVE-2020-1911—A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prEPSS 2.0%CVE-2026-58289CRITICALMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 2.0%CVE-2020-27293—Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a type confusion issue while processing project files, which may allow an attackeEPSS 2.0%CVE-2024-20662MEDIUMWindows Online Certificate Status Protocol (OCSP) Information Disclosure VulnerabilityEPSS 1.9%CVE-2021-28643LOWAdobe Acrobat Pro DC embedDocAsDataObject Type Confusion Information Disclosure VulnerabilityEPSS 1.9%CVE-2026-5946HIGHInvalid handling of CLASS != INEPSS 1.9%CVE-2023-4352HIGHType confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 1.8%CVE-2020-25661HIGHA Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with AEPSS 1.8%CVE-2020-27257—Omron CX-OneEPSS 1.8%CVE-2023-5346HIGHType confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 1.8%CVE-2026-33937CRITICALHandlebars.js has JavaScript Injection via AST Type ConfusionEPSS 1.7%CVE-2022-41033HIGHWindows COM+ Event System Service Elevation of Privilege VulnerabilityEPSS 1.7%KEVCVE-2023-24885HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.6%CVE-2023-24927HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.6%CVE-2023-24929HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.6%